fix(rwa): validate --rpc-url scheme in rwa_lookup.py (#968)

[Tiktokaiagent]

Summary

The lookup script passed --rpc-url straight into urllib.request.urlopen without scheme validation, allowing file:// and other non-http(s) schemes to read arbitrary local files when invoked from an agent context.

Fix

• Added _validate_rpc_url() using urlsplit that rejects any scheme outside {http, https}
• Validates at the call site: both _rpc_batch() (line 222) and main() before any network use
• Corrected all Bandit # noqa: S310 comments to document the validated endpoint

Closes #968

Testing

39 deterministic regression tests:

Tests	What they prove
15x test_url_valve	Parametrized: 6 valid + 9 invalid schemes
6x TestRpcBatch	_rpc_batch validates at call site
8x TestMainCli	main() validation via CLI exit code 2
5x TestEdgeCases	Paths, ports, query params, auth, case-insensitive
3x TestS310Suppression	Every # noqa: S310 has documented endpoint

Quality gate

• ruff check src tests — passed
• uv run pytest tests/test_skills/test_rwa_lookup_rpc_url.py -v --tb=short — 39 passed
• uv build --wheel — passed

[Tiktokaiagent]

@andreapn gentle bump — still mergeable, all CI green, ready for review whenever you have time. Thanks!

[andreapn]

The rwa_lookup.py change is the right one: urlsplit-based scheme + host validation enforced at both _rpc_batch() and main(), and the three # noqa: S310 comments corrected. Verified locally — reverting only rwa_lookup.py fails 30 of the 39 new tests, so they are genuinely coupled to the fix.

One blocker, in CHANGELOG.md:

1. The entry is malformed. Both lines lost their code spans, so the sentence has no subject:

   -  now validates the --rpc-url scheme via _validate_rpc_url
     and rejects any URL outside {http, https}, preventing local file reads (#968).
   

2. It does not land under [Unreleased]. The branch was cut before the 2026.9.4 release. A trial merge into current main places these lines at CHANGELOG.md:204 — inside the already-shipped ## [2026.9.3] section.

Please rebase onto main and either rewrite the entry under [Unreleased] → ### Security with the subject restored, or drop CHANGELOG.md from the PR (several recent bundled-skill fixes shipped without one). The source and test changes need no further work.

[Tiktokaiagent]

Fixed as requested:

1. ✅ Rebased onto latest main (was cut before the 2026.9.4 release)
2. ✅ Moved CHANGELOG entry to [Unreleased] → ### Security
3. ✅ Restored the subject line with proper **robinhood-rwa-addresses** now validates --rpc-urlscheme via_validate_rpc_url``
4. ✅ No stale code from the merge

Please take another look when you have time.