fix: address review feedback on redirect policy

- Replace Unicode arrows (→) with ASCII (->) in error messages and
  comments for log compatibility (gpt-review NITs #19626, #19628)
- Improve guard comment to clarify it exists for testability, not
  runtime safety (sonnet-review NIT #19619)
- Add cross-reference comments noting intentional duplication between
  gitea/client.go and github/client.go (sonnet-review #19618,
  gpt-review #19625, #19627)

Pushed back on:
- internal/ package for dedup: structural overhead not warranted for
  a single ~25-line function
- strings.EqualFold for scheme: Go's url.Parse normalizes schemes to
  lowercase, making case-insensitive comparison unnecessary

gitea/client_test.go

@@ -1176,7 +1176,7 @@ func TestDefaultCheckRedirect_RejectsHTTPSToHTTP(t *testing.T) {
 	}
 	err := defaultCheckRedirect(req, []*http.Request{prev})
 	if err == nil {
-		t.Fatal("expected error on HTTPS→HTTP redirect")
+		t.Fatal("expected error on HTTPS->HTTP redirect")
 	}
 	if !strings.Contains(err.Error(), "HTTPS to HTTP downgrade") {
 		t.Errorf("unexpected error message: %v", err)