checker: judge HTTPS redirect by chain, not FinalURL

The probe stops at scheme-changing redirects, so FinalURL keeps the
pre-redirect http:// URL while the chain records the real https://
target. Prefer the last redirect hop's destination so a correct
http→https redirect is no longer mis-flagged as no_https_redirect.

checker/rules_redirect_test.go

@@ -37,6 +37,22 @@ func TestHTTPSRedirectRule_OKViaRedirectChain(t *testing.T) {
 	mustStatus(t, states, sdk.StatusOK)
 }
 
+func TestHTTPSRedirectRule_OKViaRedirectChain_FinalURLStillHTTP(t *testing.T) {
+	// Real-world case: the probe stops at the scheme-changing redirect, so it
+	// never follows the https:// hop. FinalURL therefore remains the original
+	// http:// URL while RedirectChain records the 308 to https. This must be
+	// treated as a correct redirect, not no_https_redirect.
+	p := httpProbe("a:80")
+	p.StatusCode = 308
+	p.FinalURL = "http://example.test/"
+	p.RedirectChain = []RedirectStep{{From: "http://example.test/", To: "https://example.test/", Status: 308}}
+	states := runRule(t, &httpsRedirectRule{}, &HTTPData{Probes: []HTTPProbe{p}}, sdk.CheckerOptions{OptionRequireHTTPS: true})
+	mustStatus(t, states, sdk.StatusOK)
+	if !hasCode(states, "http.https_redirect.ok") {
+		t.Errorf("expected redirect.ok, got %+v", states)
+	}
+}
+
 func TestHTTPSRedirectRule_NoRedirect_Required(t *testing.T) {
 	p := httpProbe("a:80")
 	p.StatusCode = 200