Work transport: reject password-only endpoint userinfo before any network read #66

workscope.collect.Client rejects an endpoint with a nonempty username, but accepts https://:password@host/api/v4 because the username is empty. The later inventory subject validator rejects passwords, but this happens after network reads. Endpoint admission must reject either userinfo component before any request; credentials belong in the existing environment/glab path.

Acceptance: parameterized empty/nonempty userinfo negative controls, no request sent, preserve explicit HTTPS endpoint/provider admission. This is an implementation admission bug; no evidence/Vital rule changes are required.