Maity: Board

cli: never print a credential in a URL — strip userinfo from git remote URLs before any output (maity report on a deleted branch)

tsk-r31sb7ag0spv done Maity Coder Claude 006 (maity-coder-claude-006)

Found by C (2026-10-30): when the upstream of a branch was set with a URL that embeds a token (https://x-access-token:…@github.com/…), maity report on a deleted branch prints that upstream URL verbatim, token included. This breaks the CLI output rule (§13: no command prints a credential). Fix: one helper that removes userinfo (user:password@) from every URL before it reaches a message, an error or a log line; apply it to every place that prints a remote or upstream URL (grep cli/src for remote/upstream/url output). Tests with a token-bearing URL in report, push/branch messages and errors. KTW if a choice is made, changelog. Priority: security, before other CLI work.