feat(identity): advertise my.parachute.computer everywhere user-facing (A3 URL coherence)

[unforced]

Summary

Every vault URL the identity worker PRINTS, COPIES, or LINKS now advertises https://my.parachute.computer/vault/<name> in production instead of u.parachute.computer — the one-origin door ratified in Phase A1 (#163). u. stays a permanently recognized alias for anything that already targets it; this PR only changes what we advertise going forward.

Sites flipped (all read off the same cardFor/vaultAdvertisedUrl seam, so one fix propagates everywhere):

• Console vault cards — notesUrl/writeUrl/importUrl/mcpUrl/connectCmd (console.ts cardFor)
• The Connect-your-AI walkthrough (Claude + ChatGPT steps, copy-to-clipboard) — reads the same card, no separate fix needed
• The getting-started checklist's "Connect your AI" item + "Open your notes" doors — same card
• The account descriptor's vault_url_template (pre-creation preview) and /account/vaults + POST /account/vaults's url field — what the app renders, no app PR needed
• The day-0 welcome drip email's vault door (drip.ts notesUrlFor) — turned out to be the day-0 email, not day-3 connect-nudge (the nudge only links <app>/connect, no vault URL embedded — see "Deliberately left" below)

Mechanism: a new VAULT_PUBLIC_ORIGIN env var + vaultAdvertisedUrl(name, deps) helper in oauth-shared.ts, parallel to the existing vaultOrigin/vaultInstanceUrl. Prod's wrangler.toml sets VAULT_PUBLIC_ORIGIN = "https://my.parachute.computer"; staging leaves it unset so vaultAdvertisedUrl falls back to VAULT_ORIGIN (its own workers.dev origin, unchanged — no my. there).

Deliberately left on u./VAULT_ORIGIN (machine-reachability, not advertised copy):

• The OAuth token services catalog (buildServicesCatalog → vaultInstanceUrl) — real clients (Notes' OAuthCallback, surface-client) use this to bootstrap further REST/MCP calls, not a human-facing string; not in the brief's site list, and conformance pins it byte-for-byte against the hub.
• vault-call.ts's internal dispatch target, ops.ts's health check (GET <VAULT_ORIGIN>/health — only exists at u.'s root, my. doesn't route it), scripts/backfill-plans.ts's operator tool — all machine callers.
• smoke-staging.ts/smoke-prod.ts — audited; neither asserts on console/account-descriptor/drip advertised copy, only VAULT_ORIGIN machine-reachability (health, RFC 9728 discovery, REST). Nothing to change.
• The weekly ops digest — audited; carries no vault URLs at all (counts-only).
• iss/aud/JWKS/OAuth discovery issuer/resource-metadata/audience.ts — untouched, as directed.
• CLAUDE.md/TRYIT-2026-07-02.md/workers/vault/README.md — internal dev docs, not user-facing advertised copy; CLAUDE.md's architecture blurb is already stale post-Phase-A1 (still describes u. as THE branded vault domain) but that wasn't touched by feat(cloud): my.parachute.computer one-origin — Custom Domain + vault zone route + congruence pins (Phase A1) #163 either — flagging as a heads-up, out of scope here.
• No CHANGELOG.md exists in this repo (checked git history of recent merged PRs — none touch one); only bumped package.json.

Test plan

• bun run typecheck (root) — clean
• bun run test (root, bun test src test-bun) — 153 pass, 0 fail, 484 expect() calls, 16 files
• cd workers/identity && bun run typecheck — clean
• cd workers/identity && bun x vitest run — 766 tests passed, 31 files (grown from the 430 documented in CLAUDE.md — the count has moved since that doc was last updated)
• cd workers/vault && bun run typecheck — clean (sanity-checked; this worker isn't touched by the PR)
• Updated every test that pinned the old u. advertised form: console.test.ts, first-run.test.ts, plans.test.ts, drip.test.ts
• Left wire-level tests untouched on purpose: conformance.test.ts (services catalog, PRM resource), csp.test.ts (illustrative connect-src example), bound-origins.test.ts/console.test.ts's resolveResourceVault/congruence describes (audience.ts recognition)

Not self-reviewed — a separate reviewer will be dispatched per workspace governance.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB