feat(inference): route DNS-backed HTTPS endpoints with scoped credentials - #7188

This internal diff (PR SHA 5d639519f80fa9401d905472c9978e4583d582d7, base SHA 9d4a5c6a2fbac00a7792daf07aec5f6201451ac1) changes code that the selected credential-bearing E2E jobs or targets execute or trust (jobs: cloud-onboard, credential-sanitization, full-e2e, hermes-e2e, security-posture, inference-routing, network-policy, onboard-repair, onboard-resume).

No selected E2E job or target ran and no repository secret was exposed.

An authorized E2E reviewer must review PR SHA 5d639519f80fa9401d905472c9978e4583d582d7 against base SHA 9d4a5c6a2fbac00a7792daf07aec5f6201451ac1. Open E2E / PR Gate Controller run 30177398424, choose Review deployments, and approve the approve-credentialed-e2e-for-internal-pr environment. GitHub records the reviewer and optional comment, then the trusted controller dispatches this exact plan. If Review deployments is absent, the environment is unprotected or the run is no longer waiting; configure it, update the PR to create a new head, and trigger fresh PR CI.

The manual maintainer fallback remains available from the E2E / PR Gate Controller workflow through run-control-plane. This gate passes only if the dispatched evidence references both SHAs and verifies successfully.

Deterministic plan: 2bb65af53b0191f49a7b63983cf0b4708aac5e233e6fa7db42509b7f7f3d6369.