#34921 vault egress: no panicking index or string slice in substitute.rs

Fix-forward for #34708, which landed with seven new hits in the Rust panic ratchet (the clippy job's rust-panic-ratchet: RED, run 41780259601): a new crate is held at zero indexing_slicing and string_slice.

The wildcard host match, the DNS-name check, the placeholder scan and the Basic-scheme rewrite in cmux-tui/crates/cmux-vault-egress/src/substitute.rs now use strip_suffix, split_once and split_at_checked. Behaviour is unchanged; the crate's existing tests cover each path.

Checked: cargo fmt --check, cargo test -p cmux-vault-egress, cargo test -p acpmux vault and cargo clippy -p cmux-vault-egress -p acpmux --all-targets -D warnings on a fleet Linux run (41781774754).

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Removes all panicking index and string-slice operations from cmux-vault-egress's substitute.rs, keeping the new crate at zero hits for the Rust panic ratchet's indexing_slicing and string_slice lints. Fix-forward for #34708.

The wildcard host match, DNS-name check, placeholder scan, and Basic-scheme rewrite now use strip_suffix, split_once, bytes().next(), and split_at_checked instead. Behavior is unchanged; existing tests cover each path.