Enforce fail-closed credential and host-scoping boundaries

Treat credential routing as a strict security boundary. Resolve the active token and trusted host using the documented precedence, snapshot environment-derived trust before weaker configuration can mutate it, and scope regional caches to the control-silo origin that discovered them. Require exact normalized-origin matching, allowing only explicitly defined SaaS and registered-region exceptions. Validate every request and redirect before attaching authorization or custom headers so rejected destinations never receive credentials. Treat legitimate sntrys_ token URL claims as authoritative within the stated threat model, without allowing rc files or URL arguments to redirect them. Never expose sensitive flag values to telemetry. Add regression tests that explicitly verify credentials and headers never hit the wire on mismatches or untrusted redirects.