refactor: one helper for the unverified cross-host credential rule

main

Commit

Andrea Nodari2w ago

mayCarry, EnsureAuthForService and tryHelperRetry each spelled out "TLS verification off and another host, so no credentials". A security rule should not be able to drift between copies; crossesHostUnverified now states it once.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com Claude-Session: https://claude.ai/code/session_015oS6W9qjGMVnrTz5r8EwDL Entire-Checkpoint: 01M5D3RTAGH5944K7TTFQP0FGQ