feat(bin): support GitHub Enterprise PR URLs via config/pr-hosts allowlist

[pchuri]

Summary

Threads a validated host through fm_pr_url_parse() so an operator-approved GitHub Enterprise (GHE) host (config/pr-hosts, local and gitignored) can arm the canonical merge poll and merge through fm-pr-merge.sh with a scoped GH_HOST, while github.com keeps working byte-for-byte identically with zero configuration.

Rebuilt on top of #797's provider/host/path/number identity model (GitLab merge-request support), which landed while this branch was in flight. That model already threads a validated host generically through the entire poll prepare/publish/verify/retire chain, so this change is now surgical: only fm_pr_url_parse()'s github branch still hardcoded github.com.

• New config/pr-hosts exact-match allowlist for the github provider (RFC-1123 syntax validated, fail-closed on malformed lines, at least one dot so bare hostnames like localhost are excluded even if mistakenly allowlisted); github.com always allowed.
• Byte-static bin/fm-pr-poll.sh re-derives and re-checks the allowlist independently on every poll execution.
• bin/fm-pr-merge.sh scopes GH_HOST only as a single-command prefix for a non-github.com allowlisted host, skipped entirely for github.com; gitlab URLs are still refused by the merge path exactly as before.
• config/pr-hosts is deliberately not inherited into secondmate homes: it is a security access-control boundary, unlike operational preferences such as config/backlog-backend.
• Nothing tracked anywhere names a specific enterprise host.

Testing

• Extended tests/fm-pr-check-security.test.sh with GHE-host positive cases and adversarial-host rows (suffix tricks, port, userinfo, bare IP, localhost, double/percent-encoding, oversized host), mirroring the existing GitLab test style
• Full existing test suite passes (pre-existing, environment-only failures confirmed identical on unmodified main: Herdr-lab fleet-state tripwire, an Orca metadata-write test, and a macOS stock-bash-3.2 parser quirk in bin/fm-brief.sh unrelated to this change)
• bin/fm-lint.sh (shellcheck) clean

Pipeline

This branch was driven through no-mistakes axi run (intent/rebase/review/test/document/lint all passed for the final commit).
Its automated push step failed because the repo's origin push target resolved to the upstream kunchenguid/firstmate rather than this fork, and the authenticated identity has no write access there; the branch was pushed to this fork and this PR opened manually as the documented fallback for that routing gap.

Updates from git push no-mistakes