Use exact origin parsing in desktop credential-service lookalike-host regression

[integry]

CodeQL alert #116 identifies an incomplete URL substring assertion in apps/desktop/src/credential-service.test.ts around line 711. The test currently uses startsWith('https://attacker.example.test'), which can accept a lookalike hostname such as attacker.example.test.evil.invalid.

Make the narrow test-only correction on the desktop UX subepic branch:

• Parse the captured request URL and assert the exact canonical origin/hostname and expected pathname/query rather than a string prefix.
• Retain the test's main-only bearer/no-cookie, active scope, generation, rejection, and request-count assertions.
• Add/retain an explicit negative lookalike-host case so attacker.example.test.evil.invalid cannot satisfy the assertion.
• Do not change production credential behavior, transport authorization, current-user acceptance counts, workflow files, package-lock.json, visual geometry, or platform matrices.
• Run the focused credential-service tests, desktop typecheck, relevant lint/CodeQL-compatible analysis, and git diff --check.
• Leave the PR unmerged for independent audit. It will be merged into the UX subepic only after conflict review with active visual PR [2044 by GPT-5.6 Sol] Add packaged desktop visual and accessibility acceptance harness #2045.

This is platform-neutral cleanup for the macOS/Linux release; Windows remains deferred to #2074.

[propr-dev]

🤖 AI processing has started for this issue using codex agent with gpt-5.6-sol model.

I'll analyze the problem and work on a solution. This may take a few minutes.

Processing Details:

• Agent: codex
• Model: gpt-5.6-sol
• Branch: 2081/gpt-5.6-sol-use-exact-origin-parsing--20260902-1930-ruo
• Base Branch: 1951-epic-desktop-experience-uxs
• Worktree: issue-2081-20260902-1930-gpt-5.6-sol-ruo

🔍 Track Task Execution

[integry]

Issue/PR reconciliation: original PR #2082 was closed unmerged after its patch was transferred to #2045. Added Closes #2081 to replacement PR #2045. This issue remains open until the replacement work is integrated (current visual integration task: #2123).