Constrain temporary service-origin overrides to one environment
A temporary service-origin override should select from code-owned destinations and require both an exact environment identity and an exact enable value. An unrestricted URL variable can silently become a data-exfiltration path if it is set in the wrong environment. Keep the norma…