Support product-provided self-hosted Playground remote origins

Parent: chubes4/wp-build#1073

WordPress Build needs to point browser preview boot at a Playground remote hosted on the product runtime origin instead of `https://playground.wordpress.net`.

Current evidence:
- `wp-build` already passes `remote_url` and `client_module_url` through the boot contract.
- `wp-codebox` normalizes `playground.client_module_url` and `playground.remote_url` in `packages/wordpress-plugin/src/trait-wp-codebox-abilities-browser-runtime.php`, but the default trusted origins are only `https://playground.wordpress.net` and `https://playground.automattic.ai`.
- The browser runtime imports `boot.client_module_url` and passes `boot.remote_url` as `remoteUrl` to `startPlaygroundWeb`.

Scope:
- Add/confirm a documented product extension point for allowed Playground remote/client origins.
- Add coverage proving a product-provided same-origin remote URL is accepted without weakening default trust.
- Preserve provenance for the normalized remote/client URL so product evidence can show which origin booted.

Acceptance:
- A product can allow `https:///wp-build-playground/remote.html` without patching wp-codebox internals.
- Invalid/untrusted origins still fail closed.
- Tests cover custom origin acceptance and rejection.

Start with packages/wordpress-plugin/src/trait-wp-codebox-abilities-browser-runtime.php and trace how playground.client_module_url and playground.remote_url are normalized and checked against trusted origins. Then follow the browser runtime boot contract, including boot.client_module_url and boot.remote_url, and add coverage for product-provided same-origin acceptance, invalid-origin rejection, and preserved URL provenance.

Written by the indexing model from the issue text.