test(security): parse hostname instead of URL substring match

Replace `result.url.includes("poe.com")` / `.includes("doubao.com")` with a
parsed `new URL(result.url).hostname` check that accepts the exact host or a
legitimate subdomain (`.endsWith(".poe.com")`). The substring form also matches
hostile URLs like `https://evil.com/?x=poe.com`, which CodeQL flags as
js/incomplete-url-substring-sanitization (2 high-severity alerts on PR #2930).
This strengthens the assertion rather than masking it — the executors build
`https://www.poe.com` / `https://www.doubao.com`, both still satisfied.

tests/unit/executor-doubao-web.test.ts

@@ -20,7 +20,11 @@ describe("DoubaoWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("doubao.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("doubao.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=doubao.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "doubao.com" || host.endsWith(".doubao.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }

tests/unit/executor-poe-web.test.ts

@@ -20,7 +20,11 @@ describe("PoeWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("poe.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("poe.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=poe.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "poe.com" || host.endsWith(".poe.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }