refactor(cli): read the production origin from one constant

[A1igator]

Scope

Every production tenjin.blog reference in the CLI now reads PRODUCTION_ORIGIN from src/lib/production-origin.ts, so the tenjin.sh cutover (BackTrackCo/tenjin#402) is one edit plus a release instead of a sweep that can half-apply. Risk is a silent copy change, which the byte-identical proof below rules out.

• src/lib/production-origin.ts exports PRODUCTION_ORIGIN and a derived PRODUCTION_HOST; seven call sites import it: the baseUrl default (src/lib/config.ts), the generated WebSearch hook fallback (src/lib/hook-scripts.ts), the User-Agent comment (src/lib/client-meta.ts), the pinned fund origin (src/commands/fund.ts), the config set URL hint (src/commands/config.ts), the install hook copy (src/commands/install.ts), and the hosted-skill replacement warning (src/lib/skill-writer.ts).
• src/lib/production-origin.test.ts is the anti-half-flip guard: it pins the config default, the UA comment, the emitted hook-script fallback, and the install copy to the constant, then fails on any non-comment line under src/ that spells the host out.
• No behavior change and no semantics moved: fund keeps its hardcoded origin with no override surface (owner decision, this repo's feat(fund): let TENJIN_FUND_ORIGIN move the fund origin #146 stays closed), dual-serve is untouched, and HOOK_SCRIPT_VERSION does not move because the generated scripts hash identically.

Deliberately out of scope, because none of it is CLI runtime output: the vendored skills/tenjin/SKILL.md mirror (synced byte-for-byte from the live site by skill-drift.yml), repo-owned skill and README/docs prose, contract-drift.yml's TENJIN_CONTRACT_BASE_URL default and the dep-free scripts/*.mjs|sh (neither can import a TS constant), evals, historical changelogs, code comments, and test URLs that use the host as sample data.

One implementation note for review: in hook-scripts.ts the origin is interpolated as '${PRODUCTION_ORIGIN}' rather than through JSON.stringify (the style used for DATA_DIR), because the generated script's existing bytes use single quotes and any change there rewrites every installed hook.

Testing

• pnpm format:check, pnpm lint, pnpm typecheck, pnpm build: pass.
• pnpm test (full suite, 1854 passed / 10 skipped): pass. Two unrelated wallet-passphrase tests time out under a saturated parallel runner on my machine, on this branch and on unmodified main alike; green at --maxWorkers=3.
• bash scripts/pack-smoke.sh with CI=true: PASS.
• Byte-identity proof beyond the suite: hashed websearchHookScript() and stopHookScript() output plus TENJIN_USER_AGENT and CONFIG_DEFAULTS.baseUrl before and after the change; all four identical.

Definition of Done

• Changeset added (patch).
• Draft on purpose: this stays draft until BackTrackCo/tenjin#402 merges. The centralization can review meanwhile; ready-for-review flips only after the tenjin-side rebrand lands, and the origin flip itself is a later CLI release, not this PR.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.