Constrain temporary service-origin overrides to one environment

A temporary service-origin override should select from code-owned destinations and require both an exact environment identity and an exact enable value. An unrestricted URL variable can silently become a data-exfiltration path if it is set in the wrong environment. Keep the normal secure hostname as the default, make the exception reversible, and add tests proving that the same switch is ignored outside the intended environment.

Applies when: a non-production deployment needs a short-lived direct route while normal DNS or proxy control is unavailable. Keywords: staging endpoint override allowlist environment guard SSRF exfiltration