The probe stops at scheme-changing redirects, so FinalURL keeps the
pre-redirect http:// URL while the chain records the real https://
target. Prefer the last redirect hop's destination so a correct
http→https redirect is no longer mis-flagged as no_https_redirect.
