fix: correct mirror warnings, auth scoping, and integration coverage

- only warn about PyPy/GraalPy mirror when a custom mirror is set; the
  action.yml default made the warning fire on every run
- accept the refs/heads/{branch} raw URL form so it routes via the REST
  API instead of tripping the slash-branch warning
- scope mirror-token to the full mirror origin (scheme+host+port) so it
  can't leak to a same-host http download_url
- make an invalid mirror fatal on the auth path, matching getManifestUrl
- fix warning/docs that wrongly claimed the raw fallback is anonymous
- force a manifest fetch in the mirror integration job (check-latest) so
  it actually contacts the mirror instead of using the preinstalled cache

.github/workflows/test-python.yml

@@ -72,13 +72,16 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      # The refs/heads/ form serves the same manifest as the default mirror but
-      # deliberately does not match {owner}/{repo}/{branch}, so this exercises
-      # the direct-URL manifest fetch that the default coordinates skip.
+      # The refs/heads/ form serves the same manifest as the default mirror and
+      # exercises the refs/heads/{branch} -> {branch} parsing on the API path.
+      # check-latest forces a manifest fetch even though 3.12 is preinstalled,
+      # so the job actually contacts the mirror instead of short-circuiting on
+      # the tool cache.
       - name: setup-python with explicit mirror
         uses: ./
         with:
           python-version: 3.12
+          check-latest: true
           mirror: https://raw.githubusercontent.com/actions/python-versions/refs/heads/main
 
       - name: Run simple code