Stop ts dev lint domains reporting false-positive hosts #1417

Description

ts dev lint domains reports hosts that are not real outbound hosts. The lint-domains CI gate from #1254 stays non-required until these are fixed and #1216 lands.

Found on the gate's run against the October RC PR #1228 (28 of 54 reported hosts were false positives) and in review round 1 of #1254. Kinds:

1. URL containing a space. https://exa mple.example/x (from the unparseable-URL tests) is reported as host exa. 16 hits.
2. Deliberately invalid authorities on reserved hosts reported whole. publisher.example:65536, publisher.example:+443, publisher.example.com:invalid, 127.0.0.1:83010, and comma-joined origins such as publisher.example,https. 6 hits. A valid port (https://publisher.example:443/ok) already passes.
3. Bare placeholders. https://origin/next, //host/…. 4 hits.
4. Documentation address range. 2001:db8::1 (RFC 3849).
5. Shell-variable port. 127.0.0.1:$ORIGIN_PORT in integration-tests.yml.
6. Documentation IPv4 ranges (RFC 5737). http://192.0.2.10:8080/article in crates/trusted-server-cli/src/url_guard.rs is reported as 192.0.2.10; addresses in 198.51.100.0/24 and 203.0.113.0/24 behave the same.
7. Shell-variable port on localhost. http://localhost:$TS_PORT/health is reported as localhost:$ts_port. Kind 5 covers only 127.0.0.1.
8. Label followed by interpolation. format!("https://sync.{source_domain}/pull") in crates/trusted-server-core/src/publisher.rs and crates/trusted-server-core/src/ec/pull_sync_marker.rs is reported as sync. Kind 3 covers bare placeholders only.

Kinds 6–8 were raised in review of #1254 and still reproduce on main.

Expected

None of the above is reported. Each kind gets a test in crates/trusted-server-cli/src/commands/dev/lint/domains.rs.

Done when

• All eight kinds pass the linter, with tests
• Re-running the gate on a branch like October release candidate (DO NOT MERGE) #1228 reports only real hosts