fix(pr-triage): diagnose non-JSON model replies, never follow redirects, log credential presence

[ionite34]

The first credentialed live run (Core #100, run 33835572197) landed on the offline path with Model unreachable: JSONDecodeError: Expecting value: line 1 column 1 (char 0) about 250 ms after the request: a 2xx with a non-JSON body, which is what urllib produces when it follows a Cloudflare Access 302 to the login page. The script now says so itself.

• The model call no longer follows redirects (_NoRedirect opener). A 3xx is reported as HTTP 302 redirect to <Location host>; an Access login page means the service token was not accepted. Only the host of the Location is logged, not its query.
• A non-JSON 2xx is reported with the HTTP status, the final URL, the Content-Type and the first 120 characters of the body. Request header values are never part of the message (the e2e asserts the three credential values are absent from all output).
• At the start of the model call one line reports, for each of CF_ACCESS_CLIENT_ID, CF_ACCESS_CLIENT_SECRET, LLM_API_KEY, whether it was present and non-empty plus its length, never a character of it. That separates "headers not sent" from "sent and refused" on the next run.
• Same comment path as before (offline comment, ::warning:: in the log, exit 0). http() returns an HttpResponse (status, body, headers, final URL) instead of a tuple.

Tests, 47 → 52, all local: the fake server gained redirect and html modes. The redirect Location points back at the fake, so following it would show up as a second request; the test asserts exactly one model request and none to the login path, and that the warning names the 302 and the host. The HTML case asserts status, URL, Content-Type and the capped prefix against a body over 200 characters (my first version of that assertion was vacuous against a 103-character body, under the cap; it failed and the body got longer). Presence line pinned both ways (values set → present=True len=N; unset/empty → present=False len=0). ask_model is also called directly against the fake for both modes.

Mutation probe, committed first: flip follow_redirects=False back to True on the model call → test_access_redirect_is_reported_as_a_302_and_never_followed and test_ask_model_raises_a_diagnosable_error_on_redirect_and_html red; reverted; 52 green.

Not verified: the next live run, which is what this exists to read.

🐺 Generated with Lykos (Fable 5.1)