fix(s52): reject scheme-less webhook URL fail-fast in NotifierConfig

tests/test_notify.py

@@ -131,6 +131,22 @@ def test_config_fail_fast() -> None:
     assert isinstance(notifier, WebhookNotifier)
 
 
+def test_webhook_config_rejects_schemeless_url() -> None:
+    """Fail-fast scheme gate (S5.2 remediation): a scheme-less webhook url is rejected at config
+    construction — BEFORE it can reach ``_urllib_post``, whose bare ``ValueError`` would carry the
+    secret-bearing URL verbatim. The str/repr absence assertions guard ``hide_input_in_errors``:
+    without that flag pydantic v2 echoes ``input_value='…secret-token'`` in the error display
+    (remove the flag → RED here)."""
+    with pytest.raises(ValidationError) as excinfo:
+        NotifierConfig(type="webhook", url="hooks.example.test/T000/B000/secret-token")
+    assert "secret-token" not in str(excinfo.value)
+    assert "secret-token" not in repr(excinfo.value)
+
+    # http:// and https:// stay accepted (the gate rejects ONLY scheme-less pastes)
+    NotifierConfig(type="webhook", url="https://hooks.example.test/x")
+    NotifierConfig(type="webhook", url="http://hooks.example.test/x")
+
+
 def test_public_contract_exported() -> None:
     """The declared B11 contract is public authoring API: importable from the package top and
     listed in ``__all__`` (the brief-permitted export path — run.py's seam stays byte-intact)."""