feat(enrichment): hardcoded-URL / raw-endpoint heuristic analyzer

[JSONbored]

New REES local analyzer that flags hardcoded absolute HTTP(S) URLs and IP:port endpoints newly added in non-test, non-config source — often environment leakage or a value that should come from config. Distinct from the secret scanner (no credential); this is a portability/config-hygiene signal. Pure compute over added lines, no network.

Deliverables

• Add HardcodedUrlFinding ({ file, line, kind: 'http-url'|'ip-endpoint' }) + hardcodedUrl? key to review-enrichment/src/types.ts (host redacted or truncated, never full path/query)
• Create review-enrichment/src/analyzers/hardcoded-url.ts: match absolute URLs / IP:port on added source lines, allowlist localhost/127.0.0.1/example.com and comment/import lines, skip test+config files; cap with maxFindings
• Register a local descriptor (category 'config', cost 'local', requires ['files']) with inline render() in review-enrichment/src/analyzers/registry.ts
• Add review-enrichment/test/hardcoded-url.test.ts covering a flagged URL, allowlisted hosts suppressed, test/config skip, and the cap

References

• review-enrichment/src/analyzers/secret-scan.ts (added-line local scan; this is the non-credential sibling)
• review-enrichment/src/analyzers/registry.ts:158-175
• review-enrichment/src/types.ts:289-311

Part of #1499.

---

size: XS · gittensor:bug

[linear-code]

JSO-2144