Resolve the browser deep-link for previewing AS a role — the security-critical guard, made PURE so it is
unit-testable (the extension package has no test harness). Hard-REFUSES any non-preview env BEFORE producing
a URL (INV-08: role-preview can never target prod/local). anonymous ⇒ just the app; a role ⇒ the preview
deploy's own gated /preview/login. The extension calls this, then openExternal — it never builds the URL itself.
Resolve the browser deep-link for previewing AS a role — the security-critical guard, made PURE so it is unit-testable (the extension package has no test harness). Hard-REFUSES any non-preview env BEFORE producing a URL (INV-08: role-preview can never target prod/local). anonymous ⇒ just the app; a role ⇒ the preview deploy's own gated /preview/login. The extension calls this, then openExternal — it never builds the URL itself.