Permission controller "origins" may encompass multiple distinct websites

For websites, permission controller "origins" are actually just the hostname components of the website URL. This means that websites that should be treated as distinct—for example, sites hosted on GitHub Pages or similar hosting services—are treated as the same subject by the permission system.

The issue names no files, tests, or entry points. Start by locating the permission controller's handling of website origins in the TypeScript packages, then trace how hostname components become permission subjects. Done means distinct websites hosted under the same service are no longer treated as the same subject, with coverage for that case.

Written by the indexing model from the issue text.