Counts-only pre-deploy gate for the EPIC-KEYS-001A T1 URL policy

Count stored agent URLs that the T1 credential-carrier policy rejects.

EPIC-KEYS-001A T1 refuses userinfo, query strings, and fragments on every persisted customer-supplied URL. Rows written before that guard can still carry one, and such a row now reads back as null and fails dispatch — so the affected count is a release gate, not a curiosity: a non-zero endpoint count means real agents stop screening the moment this deploys.

This exists because host access is forbidden (CLAUDE.md rule #13 / the diagnostic-endpoint convention): without an HTTP path there is no way to take this measurement on staging or production at all.

Counts only. It never selects, returns, hashes, logs, or serializes a URL value, and it touches no credential column — the expressions below are boolean aggregates, and the response carries integers exclusively.