fix(M10): apply FIXME_M10 corrections (transport, dry_run, format, security)

Fix all 8 findings from the independent review (FIXME_M10.md):

#1 Transport compatible with slixmpp 1.17.0 (D5):
  - Use real ClientXMPP type (remove Any), JID with resource
  - connect(host, port) explicit, no use_tls kwarg
  - enable_direct_tls/enable_starttls configured before connect
  - Single timeout via asyncio.Future for session_start/failed_auth/disconnected
  - Remove premature 'starttls' in features check, remove auto_reconnect
  - try/finally guarantees disconnect on all paths (#4)

#2 Factory dry_run no longer bypassed (D6):
  - Single send() entry point in SyncXmppChannel
  - dry_run check before any ClientXMPP creation
  - Remove XmppChannel.send() dual implementation

#3 Thread daemon removed — single asyncio.run(), documented limitation

#5 Richer message format:
  - Target date header, change type [Ajouté/Supprimé/Modifié]
  - Lesson times, homework due date, message author
  - No pronote_messages duplication (external_info = blog + other_info only)

#6 Error contract unified (D6):
  - Channel.send() -> bool never raises PipelineWarning
  - Errors logged with redaction, returns False
  - PipelineWarning(step='xmpp') will be created by pipeline M11

#7 Tests faithful to slixmpp 1.17.0 API:
  - FakeClientXMPP with real connect(host,port)/disconnect() signatures
  - Assertions on host, port, resource, mtype='chat'
  - No RuntimeWarning from unawaited coroutines

#8 .secrets.baseline restored from main

Coverage: 96.44% on channels/, 600 tests pass, pre-commit all-files green.

Co-authored-by: opencode/coder <coder@agents.invalid>
Co-authored-by: opencode/test-engineer <test-engineer@agents.invalid>

.secrets.baseline

@@ -133,6 +133,49 @@
       ]
     }
   ],
-  "results": {},
-  "generated_at": "2026-09-07T21:10:53Z"
+  "results": {
+    "GUIDE_DEV_PYTHON.md": [
+      {
+        "type": "Hex High Entropy String",
+        "filename": "GUIDE_DEV_PYTHON.md",
+        "hashed_secret": "90bd1b48e958257948487b90bee080ba5ed00caa",
+        "is_verified": true,
+        "line_number": 4935,
+        "is_secret": false
+      }
+    ],
+    "tests/unit/test_caldav_gateway.py": [
+      {
+        "type": "Secret Keyword",
+        "filename": "tests/unit/test_caldav_gateway.py",
+        "hashed_secret": "1c58bd92003bbaa0538e249fff6ee19a270dec5f",
+        "is_verified": false,
+        "line_number": 152
+      },
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "tests/unit/test_caldav_gateway.py",
+        "hashed_secret": "1c58bd92003bbaa0538e249fff6ee19a270dec5f",
+        "is_verified": false,
+        "line_number": 763
+      }
+    ],
+    "tests/unit/test_caldav_security.py": [
+      {
+        "type": "Basic Auth Credentials",
+        "filename": "tests/unit/test_caldav_security.py",
+        "hashed_secret": "8e1f07a2939b6324c70f48a3e7f64b463a4a3f8b",
+        "is_verified": false,
+        "line_number": 27
+      },
+      {
+        "type": "Secret Keyword",
+        "filename": "tests/unit/test_caldav_security.py",
+        "hashed_secret": "6b554cd7b7e0115065fb4907307a74f1902154d4",
+        "is_verified": false,
+        "line_number": 28
+      }
+    ]
+  },
+  "generated_at": "2026-09-07T17:59:08Z"
 }