[Bug]: [P2] DESKTOP_ORIGIN is a cross-repo constant with no pin, and a mismatch fails silently

Found by the Edge Case Hunter reviewing analytics stage 2.

DESKTOP_ORIGIN = "app://game" in src/analyticsIngest.ts must match the origin the Electron shell actually presents. That origin is built in the private repo as ${SCHEME}://${HOST}, and I verified today that the shell has SCHEME = "app" and HOST = "game", so the constant is correct as of now.

Nothing pins it. A grep for app:// across the public repo finds the constant and its tests and nothing else: no manifest, no seam check, no cross-repo assertion.

Both failure modes are silent:

1. If the shell's host ever changes, every desktop event 403s, and the client's failure path is a rejected beacon nobody sees.
2. If Chromium serializes the shell's origin as the opaque "null" instead of the tuple form, the route accepts it anyway (the predicate allows "null"), so the constant is never exercised and the mismatch stays invisible until someone changes the host and wonders why the data stopped.

Fix shape for the shell stage: assert the constant from the shell side, either as a smoke assertion in the private repo that its computed origin equals the public constant, or by having the shell's smoke report the Origin header it actually sends (which the ruling's AC 26 already requires it to capture) and comparing it. The public repo cannot verify this alone, which is exactly why it needs a pin rather than a comment.

Start with src/analyticsIngest.ts and inspect how DESKTOP_ORIGIN and the Origin predicate are tested. Then review the shell-stage smoke requirement and its AC 26 Origin capture in the private repository. Done means a cross-repository assertion or smoke comparison detects a mismatch between the shell’s computed origin and the public constant.