Harden follow-up governance edges

[heznpc]

Summary

• harden HTTP Origin allow-list behavior for +origin network policies
• fail closed for Foundation Models write-tool stubs until HITL/rate/audit routing exists
• centralize synthetic AppEntity placeholder creation and hard-fail malformed app bundles
• reject unknown workflow CLI flags instead of falling through to catalog output

Verification

• npm test -- --runInBand tests/http-transport.test.js tests/cli-workflows.test.js tests/app-entities-source.test.js tests/foundation-models-bridge-source.test.js tests/bundle-app-source.test.js
• earlier on this branch: full npm test, typecheck, gen checks, mcp validate, app build, app verify, widget builds, app verify intents fail-fast check