Honor routed preview hosts in adaptive same-origin exploration

[chubes4]

Problem

Adaptive exploration rejects canonical runtime links as cross-origin when the browser's effective local preview origin differs from the routed public host.

In the multisite E2E rig, Playwright navigates the local preview at http://127.0.0.1:<ephemeral-port>/, while page links correctly use the WordPress canonical URL http://localhost/. The browser command declares route-host=localhost, network-policy=block, and allow-host=localhost; normal browser actions route those links back to the same disposable runtime. The adaptive descriptor filter compares link origin only against the effective 127.0.0.1:<port> origin and rejects localhost as external, preventing navigation coverage.

Evidence

• WP Codebox PR under test: Add adaptive browser state graph exploration #2030 / commit d1f6b0f6
• Homeboy rig run: a62c74fd-ae10-4187-bbbc-0427f45b392c
• Seed: extrachill-main-theme-001
• Repeated diagnostic: browser_adaptive_cross_origin_action_rejected
• Rejected hrefs: http://localhost/
• Effective browser URL: http://127.0.0.1:36571/
• Command routing explicitly declared route-host=localhost.

The result is especially damaging for WordPress multisite and canonical-host behavior: the explorer sees links but excludes them from the frontier before the existing safe routing layer can map them.

Expected

Adaptive same-origin eligibility must use the browser runtime's resolved routing/preview policy, not only raw URL origin equality. A host explicitly routed to the current disposable preview should be treated as an in-runtime navigation while undeclared external hosts remain denied.

Acceptance criteria

• The adaptive explorer receives a provider-neutral resolved navigation-scope/canonical-origin contract from existing preview routing.
• Links to the effective local origin and declared routed aliases are eligible for exploration.
• Undeclared external hosts remain rejected before navigation.
• Redirects that escape the allowed/routed scope are stopped and recorded honestly.
• Artifacts distinguish raw href origin, effective routed origin, and the policy reason for allow/reject.
• Path-based multisite links under http://localhost/<site>/ are explored through the disposable preview.
• Tests cover canonical localhost to ephemeral loopback routing, relative links, alternate routed hosts, ports, and a truly external host.
• No vendor- or product-specific host names enter runtime-core.