row 74 F25: a lane base URL's userinfo is stripped, never dialled, sent or printed, as 1.5.5 did

[MattJackson]

What

A provider (lane) base_url written as https://user:pass@host[:port]/... is ACCEPTED and its userinfo is STRIPPED where the base URL enters the served flow, so the host dialled, the certificate name, the Host/:authority on the wire and any signed host are the stripped host[:port]. The userinfo never reaches a connection, a log line, an error/fault message, or the lane tables /stats reads.

Why

1.5.5 did exactly this: v1.5.5 crates/busbar/src/proxy/egress.rs:18 (host_from_base), test crates/busbar/src/proxy/tests/auth_style_tests.rs:70. 1.6.0 refused it (the connector's carries_userinfo, split_url) with no spec line signing the change (ARCHITECT ruling, F25 row 74).

Flow points fixed

• busbar-kernel-egress trust/net.rs: new strip_userinfo (the narrowly-named entry; split_url is unchanged, so connector / a2a / oauth2 dial targets keep refusing userinfo); redact_userinfo made public.
• busbar-kernel appbuild.rs: the lane carrier's base_url is stripped. That covers the in-process lane row, egress targets, signed host, health probe, the neutral lane tables, and the boot model ... via (...) line.
• busbar root/door_steps.rs provider_routes: the door member route's base_url is stripped. That covers the sealed anchors/reach, the auth binding origin, the URL the auth plugin signs, and the connector dial.
• busbar-kernel config/sections.rs destinations(): the provider metadata carve-out now keys on the stripped base. Before, split_url read the userinfo spelling as no host and the carve-out vanished.
• busbar-kernel config_validate: the scheme, plaintext, metadata, base+path and base+path_base refusals repeat the base redacted (message literals unchanged).
• busbar-kernel plane_host/egress.rs open_http: the fault's target url is the redacted copy. open_http keeps refusing userinfo: it is reached by a2a and FFI planes, not by the provider lane flow.

REDs

• busbar-llm engine/tests/health_tests.rs a_userinfo_base_url_boots_and_its_lane_dials_the_stripped_host: real boot plus a real probe dial to a loopback far end. It checks Host is the stripped authority, no auth field carries the planted spelling or a Basic built from it, and the lane row, signed host and neutral lane view hold the stripped base.
• busbar root/tests/door_steps.rs a_provider_base_url_with_userinfo_is_reached_at_its_stripped_authority.
• busbar-kernel config_validate/tests/tests.rs a_base_url_userinfo_is_accepted_and_no_validation_error_repeats_it: the userinfo base validates, and a planted scan over every base_url refusal finds no svcuser/hunter2.
• busbar-kernel plane_host/egress_tests.rs a_guard_refusal_surfaces_class_refused_with_the_guards_own_reason: planted scan of the fault cause and target.
• busbar-kernel-egress trust/tests/net_tests.rs a_base_url_userinfo_is_stripped_to_the_host_it_names.

[MattJackson]

FYI (queue rule 20): $ draft #870 also edits crates/busbar-kernel/src/config_validate/{mod.rs:1553 rate-refusal message, tests/tests.rs:4178-4216 rate test}; hunks are disjoint from yours and merge clean.