Restrict external navigation origins

[FernandoAbishai]

Summary

• keep ScriptCut navigation locked to its exact renderer document
• continue denying all window.open requests
• only delegate external URLs for the two product-used HTTPS origins: github.com and www.python.org
• parse URLs canonically with URL.origin rather than prefix matching
• expand renderer-policy smoke coverage for userinfo/subdomain/scheme/non-default-port tricks and explicit window-open deny

Validation

• npm run smoke:renderer-policy
• npm run lint
• full npm run release:rc:arm64 -- --require-mps from the implementation commit passed renderer transport, creator qualification, MPS, signing-readiness, DMG and metadata gates
• independent read-only review: PASS, no MUST-FIX

No Developer ID signing or notarization is claimed; release candidate remains ad-hoc.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.