Validate first-party parser boundaries

vision/first-party-source-plugins.md

@@ -6,6 +6,8 @@ Compose worker. No external plugin was installed, no host was probed, and no
 live queue, delay, or container was changed. The broker, generic runner, new
 hoster pilot, admin controls, and full deployment validation below remain work
 to do; the diagram describes the target rather than the current implementation.
+Parser-result URL validation and bounded worker messages were added next; full
+redirect/DNS enforcement and source-specific CDN allowlists are still pending.
 
 ## Decision