fix(pipeline): stop creating Route nodes from URLs in config files

[mvanhorn]

What does this PR do?

Indexing a repo of only config files produced spurious Route nodes from arbitrary URL-like strings. The infra-route extractor (cbm_pipeline_extract_infra_routes in src/pipeline/pipeline.c) harvested any CBM_STRREF_URL string literal from any .yaml/.yml/.tf/.hcl/.toml file, regardless of whether the host file actually defines service routes.

This restricts the loose URL string-ref harvesting to genuine Infrastructure-as-Code files (Terraform / HCL) and additionally requires the value to be a bare URL:

• cbm_is_infra_route_source_file() — only .tf, .tf.json, .hcl are route sources. Generic config (config.yaml), dependency manifests (dependabot.yaml), container orchestration (compose.yaml), and Kubernetes / Kustomize manifests are excluded.
• cbm_is_bare_endpoint_url() — rejects command strings that merely embed a URL (e.g. a curl ... || exit 1 healthcheck), while still accepting query-string URLs.

Structured topic→endpoint bindings still flow through cbm_pipeline_process_infra_bindings(), so real infrastructure endpoints (Cloud Scheduler / Pub/Sub targets) continue to produce Route nodes.

Why this matters: per #521, a three-file repro (dependabot.yaml + config.yaml + compose.yaml) yielded four bogus routes — a Terraform registry URL, a JWKS discovery URL, an upstream service host, and a healthcheck shell command. None is a route the service serves; they inflate the Route set that get_architecture and cross-repo route matching depend on, making downstream matching noisier.

Checklist

• Every commit is signed off (git commit -s) — required, CI rejects
  unsigned commits (DCO, see CONTRIBUTING.md)
• Tests pass locally (make -f Makefile.cbm test)
• Lint passes (make -f Makefile.cbm lint-ci)
• New behavior is covered by a test (reproduce-first for bug fixes)

Testing notes

• Built the indexer and reproduced the issue: before the fix the three-file config repro produced the four Route nodes from Route nodes created from URL strings in config / non-source files #521; after the fix it produces zero. A Terraform .tf endpoint URL still produces an infra Route.
• Added unit tests in tests/test_pipeline.c:
  • infra_route_source_file_gate — Terraform/HCL accepted; dependabot/config/compose/k8s/kustomize/toml and .tfvars rejected.
  • infra_bare_endpoint_url_gate — bare URLs accepted; healthcheck/command strings rejected.

Fixes #521

[DeusData]

Huge thanks for opening this PR and for the work you put into it.

The maintainer shop is currently full, so this may sit for a bit before it gets a proper review. We will come back to this as soon as possible with real feedback; I wanted to make sure it did not sit unacknowledged in the meantime.

[DeusData]

Thanks, this is nicely scoped to #521. Before merge, please rewrite the commit metadata to remove generated/co-author/session attribution. The curl/wget strings appear to be test fixtures, not network execution.

[DeusData]

Thank you @mvanhorn — clean, well-scoped work, and you diagnosed #521 correctly (config-file URLs like the terraform-registry / JWKS / healthcheck endpoints were being harvested as bogus Route nodes).

It turns out #521 was already fixed on main by a different approach that landed right after you opened this — #667 (04697c6) uses a "deny-wins-by-value" denylist (jwks / registry / healthcheck / upstream keys + a two-pass dedup) while keeping the broad file gate, whereas this PR takes a file-type allowlist (.tf/.hcl only). Both are sound; since the denylist version is already shipped, this PR now conflicts with main and a naive resolution would regress the dedup. So I'm closing it as superseded rather than re-architecting the shipped fix.

Really appreciate the careful scoping and the repro — genuinely useful. 🙏