fix(research): extend single-label host reject to Tier-1 derivation (§1.7 backward-sweep follow-up to #857)

[artyhoo]

What & why

Follow-up to the merged #857. #857's §1.7 backward-sweep (done properly after an operator challenge) surfaced a parallel gap — but the fix landed on the branch after #857 was already squash-merged, so it did not reach staging. This PR carries just that one delta.

The gap (still open in staging): the single-label-host reject #857 added to Tier-2 (loadAckFile) had an identical sibling hole in Tier-1 derivation. tier1For's candidateFields filter rejected IP-literal / punycode / multi-tenant hosts but not bare TLDs — so a direct dependency with homepage: "https://com" (or repository: "https://io") derives a trusted Tier-1 host com, scope-locked to that package, which hostMatches then treats as authorizing every *.com for that package's research.

Reachability: non-escalating — the package must be an installed direct dependency (npm already ran its lifecycle code, a strictly larger grant). But it is a real, avoidable widening in the same class as the IP-literal / punycode rejects sitting beside it — the exact inconsistency #857 closed on the Tier-2 surface. Proved live: homepage:"https://com" → derived host com.

Fix: if (!host.includes('.')) continue; in the candidateFields loop, right after the isIpLiteral reject — so Tier-1 package-metadata hosts and Tier-2 ack hosts reject bare TLDs consistently. Paired-negative tier1.test.ts S2-N8 (com homepage + io repository → tier1For yields no host). Bundle regenerated (tier1For is bundled) — drift check green. research-source-trust.md §5 item 4 already records the both-surfaces coverage (came in via #857 commit 1's doc; this PR's source change makes it true).

This is the recursive-self-application (invariant #2) the backward-check exists to force: apply a new guard's logic to its sibling artefacts, not only the surface the finding started on.

Verification (on the current staging base)

• tier1.test.ts S2-N8 green (RED without the guard, proven by the live derivation of com/io); positive control still authorizes a legitimate two-label host
• resolver + tier1 + principle 30: 42 passed
• both single-label guards present in the resolver (Tier-2 loadAckFile + Tier-1 candidateFields)
• build:synth-bundle:check — cherry-picked bundle matches a fresh build on the staging base
• tsc --noEmit clean; markdownlint clean

§1.7 Forward-check applied

Existing disciplines checked: no-paid-llm-in-ci.md — the guard + S2-N8 are deterministic vitest, zero API-billed calls (allowlist-resolver.ts:200). doc-authority-hierarchy.md §2-§3 — research-source-trust.md's Class-A + Authoritative-for header untouched; principle 09 green. build-first-reuse-default.md — in-file guard + test, no new dependency/module; REFERENCE prior-art-evaluations.md#186-#188. ai-laziness-traps.md §2 T15 — recursive self-application: the guard is swept onto its Tier-1 sibling, not left one-surface.

§1.7 Backward-check applied

The sweep (this PR is itself the sweep result): #857's Tier-2 guard rejects single-label hosts, so I enumerated every host-derivation surface for the same class of gap: Tier-0 (ALLOWED_SOURCES curated const) — hand-curated, not human/attacker-writable, no single-label hosts, no gap; Tier-1 (tier1For candidateFields) — GAP FOUND (homepage:"https://com" → trusted com), closed here at allowlist-resolver.ts:200 + paired-negative tier1.test.ts:205 (S2-N8); Tier-2 (loadAckFile) — closed in #857. The positive control at tier1.test.ts:227 still authorizes a legitimate two-label host, and the shared-apex slice stays pinned by 30-research-source-trust.test.ts:139. No host-derivation surface is left inconsistent; §5 structure + Class-A header preserved; principle 09/30 green.