fix(auth): heal poisoned stored Nous inference URL on the no-refresh read path

[r266-tech]

Follow-up to merged #49735 (heal a poisoned Nous inference_base_url).

Problem

#49735 healed a poisoned stored URL only on the OAuth-refresh path (both refresh sites reset to the default when _validate_nous_inference_url_from_network() rejects the Portal-returned URL). But resolve_nous_runtime_credentials reads the stored inference_base_url via the unrestricted _optional_base_url (auth.py:5612), and the heal lives inside if force_refresh or invoke_jwt_status is not None:.

When the access token is still a usable invoke JWT — the common steady state — no refresh fires, the heal block is skipped, and the stored value flows straight to state["inference_base_url"] (persist) and the returned base_url. So a poisoned auth.json (e.g. a stg-inference-api... host persisted before the allowlist existed — the exact incident #49735 cites) keeps 401ing forever: a 401 from the dead inference endpoint does not trigger an OAuth refresh, so the refresh-path heal is never reached.

Fix

Validate the stored inference_base_url on read, before the or-chain, mirroring the refresh-site heal: reject → fall back to the default (which then persists, repairing auth.json on first read).

The stored value is network-provenance (it was persisted from a Portal refresh response), so validating it is consistent with the existing trust model. The user-provided NOUS_INFERENCE_BASE_URL env override stays unvalidated — it's the documented dev/staging escape hatch — by validating only the stored branch and leaving the os.getenv line untouched.

All three existing guard tests still hold:

• test_no_unvalidated_inference_base_url_assignments_remain — only state.get(...) is read via _optional_base_url; the guarded refreshed.get/mint_payload.get patterns are untouched.
• test_validator_wired_at_all_known_call_sites — the 2 refresh-site validator calls are unchanged (the new call uses stored_inference_base_url).
• test_env_override_path_does_not_call_validator — the os.getenv("NOUS_INFERENCE_BASE_URL") line never gains the validator.

Tests

New TestNoRefreshReadPathHeals (3 cases, valid token so no refresh fires): poisoned stored URL → heals to default (fails on pre-fix code); allowlisted stored URL → preserved; poisoned stored + NOUS_INFERENCE_BASE_URL env set → env value used unvalidated (escape hatch intact).

Note / scope

refresh_nous_oauth_pure accepts inference_base_url as a caller-resolved parameter and likewise doesn't re-validate it on its own no-refresh path. I scoped this PR to the documented runtime resolver (resolve_nous_runtime_credentials, matching the #49735 incident); happy to fold a symmetric guard into refresh_nous_oauth_pure if you'd prefer.

Every symbol re-read against current main. If this has already been addressed via a separate patch, feel free to close.

[alt-glitch]

Related: #49735 (heals a poisoned inference_base_url on the OAuth refresh path) and the host-allowlist validation cluster #27612/#30611.

This PR fills the gap that #49735 does not cover: the no-refresh read path in resolve_nous_runtime_credentials(). When the access token is still a usable invoke JWT, no refresh fires, and main reads the stored inference_base_url via the unrestricted _optional_base_url() and serves it verbatim — a poisoned value (e.g. a staging host persisted before the allowlist existed) then 401s forever against a dead endpoint and never self-heals (a 401 from the inference host does not trigger an OAuth refresh). Confirmed live on main (the read path has no _validate_nous_inference_url_from_network() call). Not a duplicate of #49735 — same goal, different code path.

[teknium1]

Superseded by #52270 (merged), which folds in the no-refresh-read-path heal you implemented here AND fixes the NOUS_INFERENCE_BASE_URL env-override precedence that this PR left unaddressed — your heal alone resolved a poisoned stored host to the production default, but an OAuth user with the staging env override set still couldn't reach staging because the stored (prod) value was read before the env var.

#52270 explicitly cites this PR as superseded and credits your read-path heal. Thanks for the fix — the core idea landed.