fix(#2860): drop hive-c0re's hardcoded localhost forge fallbacks

Two sites, same class, different blast radius:

`forge_http_base()` fell back to `http://localhost:3000` when
`HIVE_FORGE_URL` was unset. The NixOS module sets that variable
unconditionally, so the fallback could only ever fire for a process
started outside the module — where guessing produces a confusing
"connection refused" far from its cause. It now panics saying exactly
that.

`forge_git_url()` had a second, nastier fallback: a base URL with no
`://` produced `http://core:<token>@localhost:3000/...`, sending a
*credentialed* git push at whatever happened to answer on the local
port. Split the credential-insertion half out as `git_url_with_base`,
which panics on a malformed base.

That split also lets the tests cover the shape without setting a
process-wide env var, which would race every other test in the binary.
Adds a case pinning that the scheme is carried through rather than
assumed — the old hardcoded `http://` would have silently downgraded a
TLS-fronted forge.

Refs #2860

hive-c0re/src/forge/pr_merge.rs

@@ -253,7 +253,7 @@ pub async fn post_pr_comment(repo: &str, pr: u64, body: &str) -> Result<(), Forg
 #[cfg(test)]
 mod tests {
     use super::repo_agent_name;
-    use crate::forge::forge_git_url;
+    use crate::forge::git_url_with_base;
 
     #[test]
     fn repo_agent_name_takes_trailing_segment() {
@@ -264,13 +264,23 @@ mod tests {
 
     #[test]
     fn forge_git_url_shape() {
-        // Credentials are inserted between scheme and authority; fallback
-        // base is `http://localhost:3000` when HIVE_FORGE_URL is unset.
-        let url = forge_git_url("tok", "agent-configs/iris");
-        assert!(url.contains("core:tok@"), "must embed credentials: {url}");
+        // Tests the pure half: credentials go between scheme and
+        // authority. Deliberately not via `forge_git_url`, which reads
+        // HIVE_FORGE_URL — setting that here would race every other
+        // test in this binary, and there is no fallback to lean on any
+        // more (a guessed base is the bug this issue removes).
+        let url = git_url_with_base("http://forge.example.test", "tok", "a/iris");
+        assert_eq!(url, "http://core:tok@forge.example.test/a/iris.git");
+    }
+
+    #[test]
+    fn forge_git_url_preserves_https() {
+        // The scheme is carried through rather than assumed: a swarm
+        // whose forge is behind TLS must not be downgraded to http.
+        let url = git_url_with_base("https://forge.example.test", "tok", "a/iris");
         assert!(
-            url.ends_with("/agent-configs/iris.git"),
-            "must end with repo path: {url}"
+            url.starts_with("https://core:tok@"),
+            "https must survive: {url}"
         );
     }
 }