fix(PRD-750): correct hosted checkout popup and callback host - #451

Deployed Innovate and PT SDKs open hosted checkout on the API host and reject callbacks from the checkout web app. Add the missing .checkout. segment in the shared endpoint so popup navigation and the existing exact-origin message gate use the checkout host.

Closes PRD-750

Scope

• One runtime line, matching the narrow correction from a51ed54; no validation-branch promotion.
• Add 25 Web Test Runner regressions covering both partners, lab/production stages, default/sandbox target modes, popup session routing, completion/error/barcode handling, and unrelated/API/scheme/port/lookalike origins.
• Register the regression file in the default runner configuration. API/token endpoints and origin-validation code are unchanged.
• Based on premain at 0d6d457; targets premain.

Validation

• Before the fix: 16 focused checks failed, including wrong popup host, rejected checkout callbacks, and accepted API-host callbacks. After the fix: all 25 pass.
• Full browser suite: 129 tests across 13 files passed in Chromium, with external requests blocked.
• Focused suite with Innovate lab configuration: 25 passed; PT lab configuration: 25 passed.
• npm run lint, npm run check-ts, npm run test:types, focused Prettier check, and git diff --check: passed.
• Local production-mode npm run build:bundle passed for Innovate and PT (STAGE=paytheorylab, empty target mode), including the existing bundle side-effect checks.
• Executed both generated bundles in Chromium with mocked fetch, iframe navigation, and popup APIs: correct /hosted?sessionId=synthetic-session destination; accepted completion/barcode; rejected API and unrelated/lookalike/scheme/port/opaque origins.
• Bundle SHA-256: Innovate df12b8bfa1f5fe8cd74afc708455e8b3b63a12db1a203392722149727a04363e; PT 6b202cc7c66befedd9900cadeaeb2cab2a08373fd5e42bf3c6264264ee908c42.

Non-runs and remaining risks

• No dependency installation, publishing, deployment, AWS changes, real payment/API mutations, or merge. Browser behavior used synthetic data; live end-to-end payment confirmation is not verified.
• Existing environment fallbacks are retained to keep this change narrow. An unset STAGE still defaults to checkout, which now yields a doubled .checkout. hostname; deployments must provide the intended stage.
• Human owns merge/release. Before any separately authorized release, verify the selected source commit and artifact for both affected labs.