fix: Validate clone destinations before attaching installation tokens

[julio-rocketchat]

Summary

• Validate clone URLs before attaching an installation token or spawning Git.
• Permit HTTPS github.com destinations with the default port; reject other hosts/protocols, existing credentials, query strings, and fragments.
• Encode token delimiters through the URL API and keep setup debug output credential-free.

Verification

• Node 22: build, typecheck, lint, configuration validation, and all 632 tests passed.
• Added 13 regression cases covering destination spoofing, unsupported transports, invalid URLs, and token delimiter encoding.
• Reviewed the complete patch for credential exposure and URL-parser bypasses; Gitleaks scan of the staged patch passed.

Compatibility

This explicitly limits authenticated clones to github.com, consistent with the current GitHub API integration. No new configuration or dependencies.

[julio-rocketchat]

CI follow-up: the shared install failure was reproduced in an isolated Node 22 container. With maintainer approval, this branch now uses npm ci instead of deleting the lockfile and resolving a fresh dependency graph. This is the only CI change; GitHub checks are rerunning.