GitHub request exact-origin assertions

Trap: checking whether a request string contains api.github.com looks sufficient for proving GitHub was not contacted, but attacker-controlled hosts, paths, or query values can contain that substring. Fix: parse the request with new URL(request) and compare origin === "https://api.github.com"; exact-origin assertions prove routing without substring false positives.