Stop ts dev lint domains reporting false-positive hosts #1417

Description

ts dev lint domains reports hosts that are not real outbound hosts. The lint-domains CI gate from #1254 stays non-required until these are fixed and #1216 lands.

Found on the gate's run against the October RC PR #1228 (28 of 54 reported hosts were false positives) and in review round 1 of #1254. Kinds:

1. URL containing a space. https://exa mple.example/x (from the unparseable-URL tests) is reported as host exa. 16 hits.
2. Deliberately invalid authorities on reserved hosts reported whole. publisher.example:65536, publisher.example:+443, publisher.example.com:invalid, 127.0.0.1:83010, and comma-joined origins such as publisher.example,https. 6 hits. A valid port (https://publisher.example:443/ok) already passes.
3. Bare placeholders. https://origin/next, //host/…. 4 hits.
4. Documentation address range. 2001:db8::1 (RFC 3849).
5. Shell-variable port. 127.0.0.1:$ORIGIN_PORT in integration-tests.yml.

Expected

None of the above is reported. Each kind gets a test in crates/trusted-server-cli/src/commands/dev/lint/domains.rs.

Done when

• All five kinds pass the linter, with tests
• Re-running the gate on a branch like October release candidate (DO NOT MERGE) #1228 reports only real hosts