Move the Socket origin classifier into one module

Discovery's classifier (the memoized hosted_uuid fast path, vendor_ref
and its variants, locate, Wired, the socket-patch-<uuid> name grammar)
and the redirect's hosted URL rule (hosted_patch_uuid,
hosted_patch_url_uuids, SOCKET_PATCH_SERVER_HOST) now live in
crates/socket-patch-core/src/origin.rs, with their tests.

The code moves verbatim. DiscoverCtx holds an OriginPolicy (the
per-run origin allowlist and its memoized host set) and delegates
hosted_uuid and locate to it. vex::discover and patch::redirect
re-export the moved items, so no caller changes.

origin.rs sits outside formats/ on purpose: format models are guarded to
apply no host policy (formats/mod.rs architecture_tests).

Budget: lock-readers 30,898 -> 30,976 (49 lines moved in from
patch/redirect, ~30 lines of OriginPolicy and re-export glue);
lock-writers 88,363 -> 88,314.

No behavior change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: mikolalysenko

crates/socket-patch-core/src/lib.rs

@@ -7,6 +7,7 @@ pub mod hash;
 pub mod hosted;
 pub mod ledgers;
 pub mod manifest;
+pub mod origin;
 pub mod patch;
 pub mod policy;
 pub mod rollout;