Add BrandRef domain validation helper

[bokelley]

Summary

• add ValidateBrandDomain using the pinned public suffix list and IDNA profile
• reject unknown, public-suffix-only, IP, and special-use names in production
• expose narrow explicit development-domain options

Tests

• go test ./...
• go vet ./...

[aao-secretariat]

Ladon verdict: Approve

Approve — additive ValidateBrandDomain helper in urlutil with full test coverage.

Checked:

• No critical/high findings (row 1 clear).
• gated_paths: false — row 2 does not apply despite review_decision=REVIEW_REQUIRED.
• high_risk: false — rows 3/5 do not apply.
• No medium findings of any category (rows 4/8 clear).
• No prior escalation (row 6 clear).
• No no-auto-approve team match (row 7 clear).

The change is a fail-closed brand-domain validation helper over a pinned PSL and strict idna.Lookup profile. Only urlutil/registrable.go, its test, and go.mod/go.sum are touched — no schema/generated-types, no tmproto signing/verify surface, no identity-agent TEE boundary, no protocol-managed skills, and no exported wire/public-API removal. Reviewer traced all branches (IP rejection, special-use/development opt-in, PRIVATE-vs-unknown-TLD heuristic) against the test matrix and found them sound and covered. Falls through to row 9.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent pass, no blocking findings.

This PR touches urlutil/registrable.go, its test file, and go.mod/go.sum. It hardens ValidateBrandDomain to return bare sentinel errors instead of echoing caller-supplied input while preserving errors.Is chains (sentinels still wrap ErrInvalid). A new test, TestValidateBrandDomain_ErrorDoesNotEchoInput, locks the no-echo behavior.

Checks against repo-specific gates: no schema/generated-type changes, no tmproto signing/verification touch, no identity-agent TEE boundary changes, no protocol-managed skill edits, and no exported wire/public-API symbol removal requiring a conventional-commit marker.

Decision walk: no critical/high/medium findings (row 1 n/a); gated_paths is false (row 2 n/a); high_risk is false (rows 3, 5 n/a); no medium data-loss/schema/infra findings (row 4 n/a); prior decision was approve, not escalate (row 6 n/a); no no-auto-approve team match (row 7 n/a); zero medium findings (row 8 n/a). Falls through to row 9 → approve.