v0.10.2

Auth-transport hardening — closes the remaining findings from the v0.10.0 security red-team.

Security

Redirect-host allowlist. The pure-HTTP first-login flow follows an OIDC redirect chain that legitimately crosses two domains (us1.alteryxcloud.com and pingauth.alteryxcloud.com). The follower now validates every redirect target against an allowlist derived from the base domain: the base host, its parent domain, and sibling subdomains are permitted; anything else (evil.com, alteryxcloud.com.evil.com, a bare TLD) is refused before the request is made, so no cookies are ever sent off-domain. (red-team finding M2)
Interaction-id validation. The OIDC interaction id extracted from the redirect chain is now shape-checked (6–128 chars, alphanumeric plus _/-) before it is used to build the resume URL. Combined with the allowlist, a tampered redirect chain cannot inject an arbitrary or oversized id. (red-team finding M3)
Two more redacted error paths. The validatePasscode and /v4/auth/accounts error branches previously interpolated raw response bodies into error messages. Both now run the body preview through the redactor, matching the workspace-preflight fix in v0.10.0.

Removed a latent unwrap() in the auth diagnose envelope builder. It was safe-by-construction, but a future control-flow change could have turned it into a panic; it is now structured so the value cannot be None at that point.

18 new unit tests covering the redirect-host allowlist (exact host, parent domain, sibling subdomain, look-alike rejections, two-label-base edge case) and interaction-id validation (length bounds, charset, /token/auth skip). Total 306, up from 288.

An env:-backed secret ref (access_token_ref: env:FOO) can be materialized into a concrete secret if a profile is loaded and then re-saved, relocating the secret into the keyring or inline storage. This is not exploited by any current code path, but a future load→save round-trip should preserve env: refs as-is. Tracked for a follow-up in the secret-write path.