The forge pill loads on an app whose CSP allows only its own scripts: its tag is same-origin and its links still point at the forge #8268

The other half of #8209. Once the app host serves the pill's script, the tag should point at that copy, so a page that sends script-src 'self' (lab's production does) shows the pill. The Lost test then passes on the forge's own app.

Done when:

• [ ] toolbarTag writes src="/__forge/toolbar-<hash>.js" (same-origin), and its data attributes stay as they are and stay escaped
• [ ] The tag carries the forge's origin as data-forge. Everything in the pill that read new URL(me.src).origin (home link, pull link, "what is this" link, the crew link) now reads data-forge, so those links still lead to the forge and not to the app host
• [ ] test/apps-toolbar-same-origin.test.ts proxies an app that answers script-src 'self' and proves the tag's src is same-origin and that data-forge is the forge's origin. It fails without the change
• [ ] Look: lab production shows the pill (dot bottom-right)

Files: src/apps/toolbar.ts, test/apps-toolbar-same-origin.test.ts Risk: a page cached with the old tag still asks for the forge's /assets/ copy. Keep serving that path.