smoketest: send gitea.federated.computer/david's URL to the fake upstream too

install.sh at every baseline in smoketest/baselines clones from
https://gitea.federated.computer/david/coredesktop.git, which wasn't in
COREDESKTOP_URLS. So 30-upgrade-from-baseline installed today's real
upstream (via Gitea's redirect) instead of the baseline, and failed when
the old install.sh asked for files that have since gone.

Add a test that every URL install.sh has ever cloned from is in the list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/smoketest.bats

@@ -60,6 +60,16 @@ upstream_main() {
   done
 }
 
+@test "every URL install.sh has ever cloned from goes to the fake upstream" {
+  local repo="$BATS_TEST_DIRNAME/.." url
+  [ "$(git -C "$repo" rev-parse --is-shallow-repository)" = false ] \
+    || skip "needs install.sh's full history"
+  while read -r url; do
+    printf '%s\n' "${COREDESKTOP_URLS[@]}" | grep -qxF "$url" \
+      || { echo "install.sh has cloned from $url, which isn't in COREDESKTOP_URLS"; return 1; }
+  done < <(git -C "$repo" log -p -- install.sh | grep -oE 'https?://[^ "]*coredesktop\.git' | sort -u)
+}
+
 @test "prepare can run twice" {
   smoketest_prepare
   smoketest_prepare