openclaw - 💡(How to fix) Fix test(plugin-sdk): track origin-trust SSRF edge coverage and docs [1 pull requests]

Follow-up from #80751 multi-lane review. This is not a blocker for #80751.

#80751 now pins the SDK boundary smoke case: plugin-supplied allowedOrigins entries for metadata/link-local targets, and DNS rebinding from a trusted private origin to metadata IPs, still get rejected by the resolver.

Remaining non-blocking hardening items:

• Add origin-normalization assertions for custom provider baseUrl: trailing slash equivalence, default-port elision, and userinfo stripping via URL.origin.
• Add a concurrent multi-agent origin-trust isolation test for overlapping but distinct private baseUrls.
• Document plugin SDK origin-scoped trust semantics in docs/plugins/sdk-subpaths.md: request origin must match exactly, hostname promotion applies only to the current request, and metadata/link-local blocking remains enforced by the resolver.
• Consider adding an invariant comment for IPv6 zone-id literals being fail-closed in the loose IP parser and DNS-answer re-check.

The BLOCKED_HOSTNAMES symmetry and fakeIpPolicy endpoint-class gating notes from the review are intentionally left as maintainer-direction questions on #80751 rather than bundled into this follow-up.