feat(security): apply audited PR #6738 remediations and test hardening

- Enforce vision probe SSRF safe local host validation, SafeProbeBackend TOCTOU elimination, and session owner authorization
- Authorize session titling endpoints against registered owner configuration
- Sanitize sensitive metadata logging from agent loop debug logs
- Add async non-blocking execution for spec router tools and thinking decisions
- Harden email cache invalidation fencing and thread-safe mutation
- Add regression test suites for legacy browser authority, spec contracts, spec router request scoping, and task MCP delivery

tests/test_headless_completion_consumers.py

@@ -14,6 +14,20 @@ from src.teacher_escalation import with_teacher_takeover
 CLAIM = 'I created report.md and all tests passed.'
 
 
+@pytest.fixture(autouse=True)
+def registered_scheduler_endpoint(tmp_path, monkeypatch):
+    import core.database as database
+    from tests.helpers.database import disposable_database
+
+    with disposable_database(tmp_path) as factory:
+        monkeypatch.setattr(database, 'SessionLocal', factory)
+        with factory() as db:
+            db.add(database.ModelEndpoint(id='test-endpoint', name='test', owner='admin',
+                                          base_url='http://ep/v1', is_enabled=True))
+            db.commit()
+        yield
+
+
 def _event(payload):
     return 'data: ' + json.dumps(payload) + '\n\n'