Make Commerce plugin production-only

[wcole1-godaddy]

Summary

• make every bundled GoDaddy Commerce connection production-only
• replace configurable API origins with explicit public production endpoints
• remove private and pre-production hostnames from skills, docs, examples, and configuration
• remove the reference storefront's MCP endpoint override
• add repository-wide validation that rejects non-public GoDaddy URLs and endpoint override patterns
• refresh the Codex plugin cachebuster to 0.1.0+codex.20260806223514

Public behavior

Agents no longer ask users to choose an environment or supply an API origin. Commerce MCP, catalog, cart, OAuth, and hosted-checkout guidance all point directly to the public production services. Localhost remains only for the local reference app and Codex OAuth callback.

Safety

Production payment validation defaults to read-only or no-charge readiness checks. A real transaction requires explicit user authorization and a legitimate merchant operation; the skill forbids creating a charge merely for testing.

Validation

• repository validation passed, including the new production-host allowlist
• Storefront and Payments skill validation passed
• reference storefront: 9 tests passed
• reference storefront typecheck passed
• reference storefront production build passed
• plugin validation passed
• git diff --check passed