fix(search): validate every redirect hop

[thegeorgepu]

Summary

Addresses finding 2 in #60 by replacing automatic redirect following with an explicit, bounded redirect loop that validates every destination before the next request.

This PR also tightens the evidence contract around each hop:

• validates URL protocol and host on every redirect
• requires a non-empty DNS answer whose every address is public
• rejects missing, malformed, or unsupported Location values with typed errors
• detects redirect cycles, including cycles that begin after the initial URL
• preserves the existing maximum-hop boundary and normal successful responses

Refs #60.

Exact candidate

• base: e659ebd
• head: 3d2dbc0
• tree: eaa394f763c36fb0ad03bf64da1e05c868b131da
• paths: vinci/extensions/vinci-search.ts, vinci/extensions/vinci-search.test.mjs

Verification

• focused suite: 86/86 passing
• package tests: 30/30 passing
• production registration pin: passing
• exact old candidate behavior fails five intended new assertions
• mutation checks fail as intended when weakening all-address validation, non-empty DNS evidence, address validation, or redirect-cycle tracking
• independently reviewed: GO on this exact head and tree

Scope

This is a draft for review and hosted checks. It does not merge, release, deploy, or alter the separate Qwen/H200 worker lane.