fix(azdo): strip credentials from origin URL in the not-ready message

src/ClaudeDo.Worker/AzureDevOps/PullRequestPublisher.cs

@@ -55,7 +55,7 @@ public sealed class PullRequestPublisher
             return "Kein Azure-DevOps-PAT hinterlegt (Einstellungen → Externe Dienste) — nichts gepusht.";
         var remote = await _git.GetRemoteUrlAsync(workingDir, "origin", ct);
         return AzureDevOpsClient.ParseRemote(remote) is null
-            ? $"origin ist kein https-Remote eines Azure DevOps Servers: {remote}"
+            ? $"origin ist kein https-Remote eines Azure DevOps Servers: {System.Text.RegularExpressions.Regex.Replace(remote ?? "", "(?<=://)[^@/]+@", "")}"
             : null;
     }
 

tests/ClaudeDo.Worker.Tests/AzureDevOps/CompanyApproveTests.cs

@@ -242,4 +242,20 @@ public sealed class CompanyApproveTests : IDisposable
         Assert.Equal(0, _verify.CallCount);
         Assert.False(BareHasBranch());
     }
+
+    [Fact]
+    public async Task CheckReady_NonAdoRemote_DoesNotEchoCredentials()
+    {
+        if (!GitRepoFixture.IsGitAvailable()) return;
+        GitRepoFixture.RunGit(_repo.RepoDir, "remote", "add", "origin", "https://user:s3cret@git.example.com/x/y.git");
+        var azdo = new AzureDevOpsClient(new StubHttpClientFactory(Ado()), AzureDevOpsClientTests.PatStore(_tempDir, "geheim"));
+        var publisher = new PullRequestPublisher(_git, azdo, _db.CreateFactory(), _broadcaster, _cfg,
+            NullLogger<PullRequestPublisher>.Instance);
+
+        var msg = await publisher.CheckReadyAsync(_repo.RepoDir, default);
+
+        Assert.NotNull(msg);
+        Assert.Contains("git.example.com", msg);
+        Assert.DoesNotContain("s3cret", msg);
+    }
 }