Harden workspace manifest HTTPS redirects

[codeforester]

Summary

• Reject workspace manifest redirects that leave HTTPS.
• Verify the final manifest response URL is also HTTPS.
• Add redirect-handler coverage for allowed and rejected targets.
• Suppress only the framework-mandated argument-count diagnostics on the urllib redirect override.

Issue

Closes #1770

Validation

• Workspace-pull focused tests: 12 passed.
• Full pinned Pylint matrix for Python 3.10–3.13 passed locally and on GitHub Actions.
• Full base_projects Python suite: 1058 passed, 1 skipped, 251 subtests passed.
• compileall and git diff --check passed.

Security Notes

Manifest contents are now read only when the redirect chain and final response remain on HTTPS. HTTP redirect targets are rejected before their response body is consumed.

Demo Impact

None.

Notes

• .ai-context/ is unchanged because this is a narrow implementation and regression-test fix.

Checklist

• Tests added or updated
• No unrelated changes