fix(runner-server): attach static GitHub PAT by configured origin, not scheme (#351)

* fix(runner-server): attach static PAT by configured GitHub origin, not scheme

The static GitHub PAT was attached to action-resolution and tarball
requests only when the outgoing URL started with `https://`. Pointing the
engine at a plain-http GitHub emulator (gh-simulate local mode) therefore
silently dropped the credential, and the anonymous API budget (60/hr) was
exhausted almost immediately.

Replace the scheme check with `url_targets_configured_github`, which
attaches the PAT when the request URL's host (and effective port) matches
one of the configured `github_urls` endpoints, regardless of scheme. Real
github.com still attaches over https; an unrelated host never receives
the credential.

Refs #349

* ci: rerun checks after shared engine recovery

The previous check run used the broken macstudio golden/provisioning state.
No source files changed.

* fix(ci): re-pin dtolnay/rust-toolchain in control-plane.yml

The pinned SHA (6bed0761) is not a commit in dtolnay/rust-toolchain;
zizmor flags it as impostor-commit. Re-pin to the real stable head
89b12181 (same pin ci.yml uses).

---------

Co-authored-by: Bnjoroge1 <Bnjoroge1@users.noreply.github.com>

Author: Bnjoroge1

crates/preloop-runner-server/src/actions.rs

@@ -167,6 +167,30 @@ fn sha_entry_fresh(sha: &Option<String>, at: std::time::Instant) -> bool {
     at.elapsed() < ttl
 }
 
+/// Whether `url` targets the configured GitHub host — any of the
+/// `github_urls` endpoints — compared by host and effective port, and
+/// deliberately ignoring the scheme.
+///
+/// The static PAT must follow the engine when it is redirected to a
+/// plain-http GitHub emulator (gh-simulate local mode, `http://127.0.0.1:…`),
+/// yet must never leak to an unrelated origin. A scheme check gets the first
+/// case wrong; an origin check gets both right.
+fn url_targets_configured_github(url: &str, urls: &GitHubUrls) -> bool {
+    let Ok(target) = reqwest::Url::parse(url) else {
+        return false;
+    };
+    let Some(target_host) = target.host_str() else {
+        return false;
+    };
+    [&urls.api_url, &urls.server_url, &urls.graphql_url]
+        .iter()
+        .filter_map(|configured| reqwest::Url::parse(configured).ok())
+        .any(|configured| {
+            configured.host_str() == Some(target_host)
+                && configured.port_or_known_default() == target.port_or_known_default()
+        })
+}
+
 /// Resolve an action ref (branch, tag, or short SHA) to the commit SHA GitHub
 /// would pin for the job. Cached briefly in memory so a matrix fan-out
 /// resolves each `uses:` once per window. Returns `None` on any failure
@@ -198,7 +222,7 @@ async fn resolve_ref_to_sha(
     let url = format!("{api_base}/repos/{enc_owner}/{enc_repo}/commits/{enc_git_ref}");
     let mut request = crate::shared_http::CLIENT.get(&url);
     if let Some(pat) = state.static_github_pat()
-        && url.starts_with("https://")
+        && url_targets_configured_github(&url, &state.github_urls)
     {
         request = request.bearer_auth(pat);
     }
@@ -365,7 +389,7 @@ pub async fn download_action_tarball(
     // repos (a GitHub App installation token is scoped to the App's repos).
     let mut request = client.get(&github_url);
     if let Some(pat) = shared.state.static_github_pat()
-        && github_url.starts_with("https://")
+        && url_targets_configured_github(&github_url, &shared.state.github_urls)
     {
         request = request.bearer_auth(pat);
     }
@@ -766,6 +790,46 @@ mod tests {
         AppState::new(temp.path().to_path_buf()).await.unwrap()
     }
 
+    /// The static PAT follows the engine onto a configured plain-http
+    /// GitHub emulator, but never to an unrelated host (or a lookalike).
+    #[test]
+    fn pat_targets_configured_github_regardless_of_scheme() {
+        let sim = GitHubUrls {
+            server_url: "http://127.0.0.1:8888".to_string(),
+            api_url: "http://127.0.0.1:8888".to_string(),
+            graphql_url: "http://127.0.0.1:8888".to_string(),
+        };
+        assert!(url_targets_configured_github(
+            "http://127.0.0.1:8888/repos/o/r/tarball/main",
+            &sim
+        ));
+        assert!(!url_targets_configured_github(
+            "http://127.0.0.1:9999/repos/o/r/tarball/main",
+            &sim
+        ));
+        assert!(!url_targets_configured_github(
+            "https://evil.example.com/repos/o/r/tarball/main",
+            &sim
+        ));
+
+        // Real github.com: still attaches over https, and a different host
+        // (even a lookalike) does not.
+        let real = GitHubUrls {
+            server_url: "https://github.com".to_string(),
+            api_url: "https://api.github.com".to_string(),
+            graphql_url: "https://api.github.com".to_string(),
+        };
+        assert!(url_targets_configured_github(
+            "https://api.github.com/repos/o/r/commits/main",
+            &real
+        ));
+        assert!(!url_targets_configured_github(
+            "https://github.com.evil.example/repos/o/r/commits/main",
+            &real
+        ));
+        assert!(!url_targets_configured_github("not a url", &real));
+    }
+
     /// `archive_sha256_hex` is the lowercase hex SHA-256 of the bytes —
     /// the same value the runner computes over the downloaded archive.
     #[test]