fix(entrypoint): PING-verify Space secret Redis URLs before trusting them

A stale secret (expired Upstash DB, NXDOMAIN) shadowed the local sidecar
and crash-looped the Celery worker -> RUNTIME_ERROR. Dead secrets are now
ignored and the sidecar takes over.

Co-Authored-By: Claude Code <noreply@anthropic.com>

entrypoint.py

@@ -5,8 +5,11 @@ Container entrypoint for BRIDGE Modul-X on Hugging Face Spaces.
 Responsibilities
 ----------------
 1. Ensure Redis for cache + Celery broker/results, in priority order:
-   a. Space secrets win: REDIS_URL / CELERY_BROKER_URL / CELERY_RESULT_BACKEND
-      (any non-localhost URL).
+   a. Space secrets win ONLY if they answer PING:
+      REDIS_URL / CELERY_BROKER_URL / CELERY_RESULT_BACKEND.
+      (A stale secret — e.g. an expired Upstash DB whose domain no longer
+      resolves — must never shadow the sidecar; it used to crash-loop the
+      whole app.)
    b. Otherwise run a local redis-server sidecar on 127.0.0.1:6379
       (installed in the image; volatile memory, no persistence). This is the
       default production path — no external dependency, no expiry.
@@ -95,11 +98,23 @@ def _resolve_redis(children: dict):
     broker = _secret_url("CELERY_BROKER_URL")
     result = _secret_url("CELERY_RESULT_BACKEND")
     if cache or broker or result:
-        print("[ENTRYPOINT] using Redis from Space secrets", flush=True)
-        cache = cache or broker or result
-        broker = broker or cache
-        result = result or broker
-        return cache, broker, result
+        # Trust-but-verify: every provided secret URL must answer PING,
+        # otherwise ignore all of them and use the sidecar instead.
+        dead = [
+            u for u in (cache, broker, result) if u and not _wait_for_redis(u, seconds=6)
+        ]
+        if not dead:
+            print("[ENTRYPOINT] using Redis from Space secrets (PING ok)", flush=True)
+            cache = cache or broker or result
+            broker = broker or cache
+            result = result or broker
+            return cache, broker, result
+        print(
+            "[ENTRYPOINT] WARNING: Space secret Redis unreachable "
+            f"({len(dead)} of the URLs failed PING) - ignoring secrets",
+            flush=True,
+        )
+        cache = broker = result = None
 
     # Local sidecar: same image, same container, always reachable.
     try: