fix: [DIRECT] Add a fail-closed API test for stale domain origins

[ahteshamhassan7933-gif]

Fixes #684

Autonomous fix by RIZQ AI agent.

Closes #684

[NSPG13]

Thanks for targeting #684. The PR contract check passes and a fail-closed origin test is the correct kind of regression.

This cannot enter main because it deletes the working tools/feed_generator.py and replaces it with pasted diff markers and a placeholder pass; the actual API/origin test files are not changed. The resulting file is not a valid implementation of the issue.

Please:

1. Restore tools/feed_generator.py from main.
2. Put the test in the real API test module that constructs the canonical public origin/configuration.
3. Cover the stale configured origin, stale generated origin, and current https://agentbounties.app case, and prove failures are closed rather than silently rewritten.
4. Run the focused Cargo test and python scripts/check.py --platform posix.

A collaboration branch is not appropriate until the destructive unrelated replacement is removed. This issue is not canonically funded; only a confirmed BountySettled event proves payment.

[NSPG13]

This PR remains in manual-security review with requested changes. What passed: it targets issue #684. What blocks main: the allowlist and proxy/header semantics need security review and overlap #740, #743, and #760. Action: resolve existing review threads, consolidate duplicate scope, run cargo run -p cli -- docs-contract-check and cargo test -p api, and add allowed/stale/malformed/forwarded-origin fixtures. Thanks for helping the community grow, and sorry for the review friction.