feat(ramps-controller)!: source widened Headless Buy default redirect URL from RampsService - #9752

## Explanation

Automated release bump created with `yarn create-release-branch` for:

- `@metamask/ramps-controller` `18.0.1` to `19.0.0` (major). Unreleased
includes breaking changes from MetaMask#9752 (remove `getDefaultRedirectUrl`
from `RampsControllerOptions`; require
`RampsService:getDefaultRedirectCallbackUrl` delegation) plus the new
`setSelectedProviderForAsset` API and `providerServesAsset` fix from
MetaMask#9759.
- `@metamask/transaction-pay-controller` `26.2.0` to `26.2.1` (patch).
Included as a direct dependent of the major bump so its
`@metamask/ramps-controller` range moves to `^19.0.0`. Also publishes
the pending `@metamask/network-controller` bump.

SemVer: major is required because of the MetaMask#9752 BREAKING entries in
Unreleased; a minor would be wrong even though MetaMask#9759 alone would have
been a minor.

## References

- Related to MetaMask#9759 (`setSelectedProviderForAsset` and
`providerServesAsset` fix)
- Related to MetaMask#9752 (Headless Buy default redirect URL sourced from
`RampsService`; breaking for hosts)
- Consumer mobile adoption for MetaMask#9759: MetaMask/metamask-mobile#34195
- Breaking-change consumer note from MetaMask#9752: hosts must drop
`getDefaultRedirectUrl` and delegate
`RampsService:getDefaultRedirectCallbackUrl` (or spread
`RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS`)

## Checklist

- [ ] I've updated the test suite for new or updated code as appropriate
- [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or
updated code as appropriate
- [x] I've communicated my changes to consumers by [updating changelogs
for packages I've
changed](https://github.com/MetaMask/core/tree/main/docs/processes/updating-changelogs.md)
- [x] I've introduced [breaking
changes](https://github.com/MetaMask/core/tree/main/docs/processes/breaking-changes.md)
in this PR and have prepared draft pull requests for clients and
consumer packages to resolve them

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Low direct code risk in this diff, but shipping ramps-controller
19.0.0 forces consumer migrations (messenger delegation, dropped
`getDefaultRedirectUrl`) and can break MM Pay fiat quoting if hosts are
not updated.
> 
> **Overview**
> This is an **automated release cut** (no application code in the
diff): it finalizes versions and changelogs so npm consumers pick up
ramps work that landed in earlier PRs.
> 
> **`@metamask/ramps-controller` `19.0.0` (major)** moves Unreleased
notes into `[19.0.0]`. Hosts upgrading get **breaking** Headless Buy
redirect wiring: `getDefaultRedirectUrl` is removed from
`RampsControllerOptions`, widened `getQuotes` paths must delegate
**`RampsService:getDefaultRedirectCallbackUrl`**, and defaults come from
**`RampsService` / `getDefaultRedirectCallbackUrl(environment)`**. The
release also documents **`setSelectedProviderForAsset`** plus a
**`providerServesAsset`** fix (map values must be `true`).
> 
> **`@metamask/transaction-pay-controller` `26.2.1` (patch)** bumps
**`@metamask/ramps-controller`** to `^19.0.0` as a direct dependent and
records a pending **`@metamask/network-controller`** `^35.0.1` bump. The
root monorepo version becomes **`1172.0.0`**; **`yarn.lock`** is updated
accordingly.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
277ec22. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

…Mask#34207)

<!--
Please submit this PR as a draft initially.

Do not mark it as "Ready for review" until this PR meets the canonical
Definition of Ready For Review in `docs/readme/ready-for-review.md`.
-->

## **Description**

<!-- mms-check: type=text required=true -->

Adopts the TRAM-3757 core change from MetaMask/core#9752 so Headless Buy
and UB2 share one finish-line (fake-callback) URL derivation.

- Bumps `@metamask/ramps-controller` to the stable published `^19.0.0`
release.
- Removes the client `getDefaultRedirectUrl` injection from
`ramps-controller-init.ts`. Core now supplies the widened-path default
through `RampsService:getDefaultRedirectCallbackUrl`.
- Spreads `RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS` in the controller
messenger so the new action cannot be forgotten on future upgrades.
- Rewrites `getRampCallbackBaseUrl()` as
`getDefaultRedirectCallbackUrl(getRampsEnvironment())`, deleting the
duplicated host table. BuildQuote, Continue rewrite, Checkout completion
matching, and the controller default now all use the same environment
source (`RAMPS_ENVIRONMENT`, then `METAMASK_ENVIRONMENT`).

## **Changelog**

<!-- mms-check: type=changelog required=true blocking=true -->

CHANGELOG entry: null

## **Related issues**

<!-- mms-check: type=issue-link required=true -->

Fixes: TRAM-3757
Refs: MetaMask/core#9752

## **Manual testing steps**

<!-- mms-check: type=manual-testing required=true -->

N/A - unit-covered wiring and package bump only. Covered by unit tests
for `getRampCallbackBaseUrl` (parity with
`getDefaultRedirectCallbackUrl(getRampsEnvironment())`, including
`RAMPS_ENVIRONMENT` override), `ramps-controller-init`, and messenger
construction.

## **Screenshots/Recordings**

<!-- mms-check: type=screenshot required=true -->

N/A - no user-visible UI change; wiring/package bump only.

### **Before**

N/A

### **After**

N/A, simply proving that UB2 still works.


https://github.com/user-attachments/assets/61bf61fb-765c-4fe1-923c-3ce03d4e5d1e



## **Pre-merge author checklist**

<!-- mms-check: type=checklist required=true -->

- [x] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I've included tests if applicable
- [x] I've documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I've applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

#### Performance checks (if applicable)

- [ ] I've tested on Android
  - Ideally on a mid-range device; emulator is acceptable
- [ ] I've tested with a power user scenario
- Use these [power-user
SRPs](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/edit-v2/401401446401?draftShareId=9d77e1e1-4bdc-4be1-9ebb-ccd916988d93)
to import wallets with many accounts and tokens
- [ ] I've instrumented key operations with Sentry traces for production
performance metrics
- See [`trace()`](/app/util/trace.ts) for usage and
[`addToken`](/app/components/Views/AddAsset/components/AddCustomToken/AddCustomToken.tsx#L274)
for an example

For performance guidelines and tooling, see the [Performance
Guide](https://consensyssoftware.atlassian.net/wiki/spaces/TL1/pages/400085549067/Performance+Guide+for+Engineers).

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes ramp buy/checkout redirect URL resolution for headless and UB2
flows; behavior should match prior mapping but depends on core v19 and
messenger delegation being correct.
> 
> **Overview**
> Bumps **`@metamask/ramps-controller`** to **^19.0.0** (TRAM-3757 /
core#9752) so the widened Headless Buy quote path gets its default
redirect from core instead of the mobile client.
> 
> **`getRampCallbackBaseUrl()`** no longer maintains a local host switch
on `METAMASK_ENVIRONMENT`; it delegates to
**`getDefaultRedirectCallbackUrl(getRampsEnvironment())`**, aligning UB2
BuildQuote, checkout completion, and Continue rewrite with the same env
source (`RAMPS_ENVIRONMENT`, then `METAMASK_ENVIRONMENT`).
**`ramps-controller-init`** drops the **`getDefaultRedirectUrl`**
injection into **`RampsController`**.
> 
> The ramps controller messenger now spreads
**`RAMPS_CONTROLLER_REQUIRED_SERVICE_ACTIONS`** instead of a
hand-maintained action list, so
**`RampsService:getDefaultRedirectCallbackUrl`** stays delegated on
upgrades. Tests assert parity with core and **`RAMPS_ENVIRONMENT`**
override behavior.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
721b70e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->