test(installer): pin B8 redaction evidence

tools/install-next-lane.test.sh

@@ -476,8 +476,10 @@ if grep -qF "$canary" <<<"$OUTPUT"; then echo 'credential canary leaked to termi
 if grep -Eq 'alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789' <<<"$OUTPUT"; then
   echo 'credentialed URL userinfo leaked to terminal output' >&2; exit 1
 fi
-[[ "$(grep -oF '[REDACTED]@' <<<"$OUTPUT" | wc -l | tr -d ' ')" -ge 5 ]] \
-  || { echo 'credentialed URL redaction controls were not all exercised' >&2; exit 1; }
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" <<<"$OUTPUT" \
+    || { echo "credentialed URL redaction control missing for $host" >&2; exit 1; }
+done
 secret_active="$TMP/secret-state/active.json"
 secret_journal="$(node -p "require('$secret_active').journal")"
 secret_command_log="$(dirname "$secret_journal")/commands.log"
@@ -524,8 +526,10 @@ if grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass
   || grep -Eq "$canary|alice:p@ss|bob:pa:ss|carol:p%40ss|token@example|user%3Apass|QWxhZGRpbjpvcGVu|Ym9iOnNlY3JldA|session=abc123|sid=xyz789" "$framework_log"; then
   echo 'framework nested capture leaked credential diagnostics' >&2; exit 1
 fi
-[[ "$(grep -oF '[REDACTED]@' "$framework_log" | wc -l | tr -d ' ')" -ge 5 ]] \
-  || { echo 'framework URL redaction controls were not exercised' >&2; exit 1; }
+for host in example.com example.net example.org example.dev example.io; do
+  grep -qF "https://[REDACTED]@$host" "$framework_log" \
+    || { echo "framework URL redaction control missing for $host" >&2; exit 1; }
+done
 
 printf '[test] real P2-P8 actions run under fault injection and restore actual surfaces\n'
 for phase in P2 P3 P4 P5 P6 P7 P8; do