chore: clean up Obsidian scan compatibility boundaries

[ClaudiaFang]

Summary

• Explicitly exclude e2e/** and scripts/** from the Obsidian runtime lint pass while retaining strict rules for shipping plugin code.
• Add npm run check:obsidian-compat, which inspects built main.js for static node:crypto, node:child_process, node:util imports and direct native fetch() calls.
• Preserve the existing requestUrl architecture: GitHub, GitLab, and Gitea use BaseGitService.safeRequest().

Official scan audit

Warning category	Runtime classification	Result
fetch	Node E2E verifiers/provisioning/shim	Intentionally retained; excluded from plugin lint
globalThis	Vitest/jsdom and E2E window shim	Intentionally retained; not shipping code
node:crypto, node:child_process, node:util	E2E provisioning and CI scripts	Intentionally retained; not bundled
Bare timers	Shipping code	Already window-qualified
Native fetch / Node imports in src/**	Plugin runtime	None found

main.js passes the production compatibility guard with no prohibited Node imports or direct native fetch calls.

Verification

• npm run lint
• npm run build (including Obsidian 1.11.0 compatibility typecheck)
• npm test — 513 passed
• npm run check:obsidian-compat
• npm run test:e2e -- --provider gitea — 7 passed

Official scanner follow-up

The shared CI workflow has no local official-marketplace scanner command. Re-run the external official scan after this PR is submitted. If it still reports E2E/tooling hits, document them as scanner-scope findings rather than rewriting valid Node tooling.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud