fix: harden prompter popout URLs

[Brad-Edwards]

Summary

Harden the prompter popout helper so it parses target URLs through the platform URL API, forces mode=prompter, rejects cross-origin targets, and isolates the opened window from window.opener.

Requirement UIDs

• (none - bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #150

ADR Impact

• None

Changes

• Build prompter popout URLs with new URL(baseUrl, window.location.href) and searchParams.set('mode', 'prompter').
• Reject cross-origin popout targets before calling window.open.
• Always include noopener,noreferrer and defensively clear opened.opener when a window object is returned.
• Expand system tests for existing mode params, query values containing mode=, hashes, relative URLs, absolute same-origin URLs, cross-origin rejection, feature isolation, and opener clearing.
• Add a fixed changelog fragment.

Test Plan

• pnpm vitest run tests/system/prompter-window-url.test.ts
• pnpm lint
• pnpm typecheck
• pnpm test
• pre-commit run --all-files
• CI passed on PR fix: harden prompter popout URLs #157
• SonarCloud checks passed on PR fix: harden prompter popout URLs #157

Codex pre-push review was clean. Test-quality pre-push review was clean.

Ground Control Checks

• Implementation plan posted
• Completion gate passed
• Codex review clean
• Test-quality review clean
• CI green
• SonarCloud quality gate OK

Traceability

• IMPLEMENTS: issue Use URL parsing and opener isolation for prompter popout windows #150 <- src/system/presenter/prompter-window.ts
• TESTS: issue Use URL parsing and opener isolation for prompter popout windows #150 <- tests/system/prompter-window-url.test.ts

Checklist

• Changelog fragment added at changelog.d/150.fixed.md
• Issue Use URL parsing and opener isolation for prompter popout windows #150 closed
• in-progress label removed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
87.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud