Clean up pre-existing non-allowlisted URL hosts so the full-repo audit can gate #1216

Description

Bringing .md, .rs, config, and TS/JS into the domain linter's scope surfaced a backlog of pre-existing non-allowlisted hosts. The full-repo audit (ts dev lint domains with no arguments) is deliberately diagnostic-only in Stage 1 so this can be cleaned incrementally — but the spec is explicit that it is a "committed workstream, not 'incidental noise we'll get to.'"

With #1160 closing on #733's merge, nothing tracks that workstream. Hence this issue.

Current measured state

Full audit run at #733 head fcba41de0: 486 violations across 89 files.

By file kind:

Highest-count files:

Proposed solution

Work the backlog down to zero using the spec's cleanup policy, in priority order:

1. Strongly prefer rewriting illustrative placeholder hosts to RFC 2606 reserved names — *.example.com, *.example, *.test, *.invalid, *.localhost. This is also the answer for multi-line fenced code blocks, since the linter intentionally has no block-level suppression (rejected in the spec's resolved decisions as state-tracking complexity, with rewriting to reserved hosts covering the multi-line case).
2. Add legitimate integration or vendor hosts to the appropriate allowlist constant when the host appears in multiple files and has a real integration backing it. Two existing-backlog items to triage this way: api.lockr.io (the spec cites it as an integration EXACT_HOSTS candidate, conditional on verifying it is actually proxied) and aps.amazon.com (a REFERENCE_HOSTS candidate if it is linked repeatedly, otherwise a per-line suppression).
3. Suppress per-line with // allow-domain: <host> only for true one-offs — an attacker placeholder in a security test, or a single external citation.

The spec warns explicitly that suppressing 20 occurrences of the same placeholder is a smell: rewrite to a reserved name instead.

Sequencing

Per the spec, the cleanup PR(s) land after Stage 1 ships but before the Stage 2 CI gate. That way contributors get local hook protection immediately while the cleanup proceeds in parallel, without the cleanup blocking the release. Completing this also unblocks Stage 3 (the full-repo audit as a gate), tracked as a follow-on in #1215.

Because it touches 89 files, split into reviewable batches by area rather than one enormous PR — for example docs/guide separately from crates/trusted-server-core, and the test HTML fixture on its own. Each cleanup PR should run the linter's --changed-vs main mode as a self-check.

Done when

• ts dev lint domains with no arguments exits 0 on a clean checkout.
• Illustrative placeholder hosts use RFC 2606 reserved names.
• Legitimate vendor and integration hosts are on an allowlist constant, with the integration verified as real before it is added.
• Per-line allow-domain: suppressions are limited to genuine one-offs, not bulk placeholder occurrences.
• Cleanup lands in area-scoped batches, each self-checked with --changed-vs main.
• A decision is recorded on Stage 3: clean-and-gate vs a snapshotted baseline file.

Affected area

docs/, crates/trusted-server-core, crates/trusted-server-cli (allowlist constants), developer tooling, Documentation.

Design

• Spec: docs/superpowers/specs/2026-05-18-check-domains-design.md, sections Stage 1 Doc Cleanup Plan (including its cleanup policy) and Migration to CI.
• Stage 1 (the linter and the hook) ships in Add ts dev lint domains and ts dev install-hooks to block non-allowlisted URL hosts #733, which closes Block non-allowlisted URL hosts from entering the repository #1160.
• Stage 2 (the PR CI gate) is Add a CI gate for non-allowlisted URL hosts on changed lines #1215, sequenced after this cleanup.