Harden Bake browser input and development origins

Context

The pinned Bun Bake ESM corpus at 4982b91e3702094330f3be3883354c52b8c01323 contains browser-input hardening added in Bun's round-4 hardening commit. Home reproduced three failures:

• browser console forwarding wrote OSC 52 and other control bytes to the developer terminal;
• URL origin normalization could return a length larger than the borrowed input (http:h -> http://h/), causing an index-out-of-bounds panic;
• HTML routes served secret-bearing /_bun/client/... URLs to a foreign Host header.

The same upstream boundary also protects HMR WebSocket upgrades by validating both Host and browser Origin.

Scope

• Sanitize error-report strings and browser console forwarding before terminal output, including C0, DEL, and UTF-8 encoded C1 controls.
• Reject native normalized-origin lengths that exceed the supplied URL slice.
• Validate development HTTP Host authorities for internal, framework, and HTML routes.
• Validate HMR WebSocket Origin against the request host while retaining non-browser clients.
• Preserve localhost, .localhost, IP literal, and explicitly configured hostname access.

Acceptance criteria

• The three unchanged pinned hardening tests in bake/dev/esm.test.ts pass through Home's native VM.
• Native unit tests cover terminal sanitization, URL length rejection, and fail-closed authority parsing.
• Existing Bake HTML/HMR and runtime gates remain green.
• No upstream fixture or assertion is weakened.

Child of #555. Tracked by #66.

Resolved on main by ebc7ac7 (fix(runtime): harden Bake browser inputs).

This ports the pinned Bun browser-input hardening into Home Bake:

• rejects missing, malformed, and foreign Host authorities on internal routes, HTML routes, and HMR upgrades;
• validates browser WebSocket Origin while retaining origin-less non-browser clients;
• strips terminal control bytes from error reports and forwarded browser console messages without changing inspector payloads;
• rejects native URL origins whose normalized length exceeds the supplied input;
• adds native and maintained integration regressions for each Home-side boundary.

Verification:

• unchanged pinned bake/dev/esm.test.ts: 16 passed, 1 failed, 46 assertions (up from 13/4; the sole remaining case is tracked in #558);
• the three exact hardening cases pass independently: console forwarding 1/1, 4 assertions, normalized browser origin 1/1, 2 assertions, foreign Host 1/1, 5 assertions;
• maintained test-bake-development and test-bake-production pass;
• debug builds pass with JSC disabled and enabled;
• home_rt: 1,811 passed, 19 skipped, 0 failed;
• retained 12-file Bake aggregate: 84 passed, 1 upstream todo, 0 failed, 249 assertions, plus the expected deinitialization child 9/9, 32 assertions;
• vendored pinned Bake corpus remains byte-exact: 43/43 files, with no missing, extra, or changed files;
• targeted Pickier, Python compilation, and git diff --check pass.