Prevent proxy credential leakage from urlparse errors

[groupthinking]

Stop logging proxy URL parse errors that can include credentials, and align yt-dlp proxy validation with the shared helper.

[linear-code]

GRV-189

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[groupthinking]

Blocker-watch execution receipt — changed security blocker

• Agent login: Codex (connected GitHub actor: groupthinking)
• Run ID: eventrelay-blocker-watch-20260731T051136Z
• Canonical unit: Prevent proxy credential leakage from urlparse errors #1113 / PR fix(security): stop proxy credentials leaking from subprocess errors #1118 / groupthinking-fix-proxy-credential-leakage-and-vacuous
• Claimed: 2026-07-31T05:11:36Z
• Latest heartbeat: 2026-07-31T05:15:32.196Z
• Exact head: 370f7cd3c84f9aaccb221125d9d033d545b3bfed
• Base: main@abd93326b1a58cb45aaf1c120d3737174b74a201

PR #1118 was returned to draft after Vercel review 4825642636 identified four raw DEBUG exception sinks in _transcript_operation that may disclose proxy userinfo (CWE-532). The prior CodeRabbit findings are resolved and CodeRabbit approved this exact head, but this later security finding is substantive and remains unproven. Repository search did not locate the named function/file on the exact head, so no speculative code change or review-thread resolution was attempted. Keep the canonical PR draft until the finding is mapped to exact file/lines, patched on this branch, and verified on the new exact head. This receipt covers containment only.