plane(1.3): host-literal scan test over src, plane, ops and docs

tests/test_plane_literals.py scans src/, plane/, ops/ (minus ops/ax/up.sh and
ops/k8s/profiles/) and docs/ for the kind context, the kind registry, the kind
network's gateway, a loopback address with a port and port-forward; router.py
keeps the last two, a line tagged ax-tunnel or loopback is allowed, and a
committed template's digest-pinned image is accepted only while it names the
kind profile's registry (checked by a third test). A self-check reinserts each
literal into a fixture and sees it caught. The runner's health URL and the Joern
session's query URL are tagged loopback; docs/deployment.md and ops/ax/README.md
stop naming this host and describe the kube context and the registry as the
profile's (what 1.2 made configurable).

Gates: pytest 2009 passed, 42 skipped, exit 0; ruff check 0; ruff format 0;
mypy 0; mkdocs build --strict 0.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

src/openultrasast/cpg/session.py

@@ -162,7 +162,9 @@ class EngineSession:
             return None
         payload = json.dumps({"query": code}).encode()
         call = urllib.request.Request(
-            f"http://127.0.0.1:{self._port}/query-sync", data=payload, headers={"Content-Type": "application/json"}
+            f"http://127.0.0.1:{self._port}/query-sync",  # loopback: the Joern server this process started
+            data=payload,
+            headers={"Content-Type": "application/json"},
         )
         try:
             with urllib.request.urlopen(call, timeout=timeout) as response:  # noqa: S310 -- fixed loopback URL

src/openultrasast/plane/runner.py

@@ -925,7 +925,7 @@ def main(argv: Sequence[str] | None = None, environ: MutableMapping[str, str] |
         metadata = {"task": env.get("AX_TASK_YAML", ""), "workspaces": env.get("AX_WORKSPACES_YAML", "")}
         server = start_health_server(int(env.get("AX_RUNNER_PORT", str(DEFAULT_PORT))), ready, metadata, gate)
         env["AX_RUNNER_BOUND_PORT"] = str(server.port)
-        env["AX_METADATA_URL"] = f"http://127.0.0.1:{server.port}"
+        env["AX_METADATA_URL"] = f"http://127.0.0.1:{server.port}"  # loopback: this runner's own health server
         log.info("health and metadata server on port %d", server.port)
     try:
         if server is None and env.get("AX_RUNNER_AUTOSTART") != "1":