fix(auxiliary): gate Anthropic base_url override on Anthropic-compatible host (#52608)

[Tranquil-Flow]

Summary

agent/auxiliary_client.py::_try_anthropic() unconditionally applies cfg["model"]["base_url"] as the auxiliary Anthropic base_url whenever cfg["model"]["provider"] == "anthropic" — even when that URL points at a different provider's endpoint (e.g. OpenRouter, OpenAI).

When operators run with:

model:
  provider: anthropic
  base_url: https://openrouter.ai/api/v1

…the main session works (main code path attaches the right key), but every auxiliary call (memory-provider extractors, reflection extractors, title-generation, vision passes, session-search) hits the override path and sends ANTHROPIC_API_KEY to the foreign host, which rejects it with 401 Missing Authentication header.

Fix

Add a hostname validation gate (_is_anthropic_compatible_host()) before applying the config override. Only api.anthropic.com (and its path variants) are treated as safe Anthropic-compatible endpoints. Non-Anthropic hosts fall back to _ANTHROPIC_DEFAULT_BASE_URL.

Test plan

• 5 regression tests in test_auxiliary_client_base_url_host_validation_52608.py — all pass with fix
• 2 tests fail without the fix on upstream/main (RED proven): OpenRouter leak + OpenAI leak
• 225 existing test_auxiliary_client.py tests pass — no regressions
• Edge cases: empty base_url, Anthropic default host preserved, Anthropic host with path suffix preserved

python3 -m pytest tests/agent/test_auxiliary_client_base_url_host_validation_52608.py -v -o addopts=
# 5 passed

Fixes #52608

Auto-published by Moonsong via Path B automated pipeline.

[kshitijk4poor]

Salvaged into #52891 (rebased onto current main, 101 commits ahead — cherry-pick applied cleanly). All credit to @Tranquil-Flow for the original fix. Thanks for the contribution!

Note: PR #52888 (AUTHOR_MAP chore) must merge first — it adds the Tranquil-Flow email mappings.