feat(spec)!: standardize route hostnames

[vishr]

Summary

• introduce the onebox.run/v2 project contract
• replace domain and wildcard_suffix routing fields with routes[].hostname
• accept exact hosts and literal leftmost wildcards such as *.example.com
• preserve frozen v1 schema URLs and migrate v1 release snapshots only for rollback/recovery
• update fixtures, generated schemas, docs, site examples, and CI smoke coverage

Breaking migration

• domain + port becomes routes: [{hostname: host, port: port}]
• wildcard_suffix: example.com becomes hostname: *.example.com
• authored v1 projects are rejected by the v2 loader; immutable v1 release snapshots remain replayable

Verification

• just ci
• independent Astra review: no major+ findings
• independent Cavecrew review: no findings
• browser QA of every landing-page example toggle