Work queue rejects GitHub Enterprise Cloud (ghe.com) hosts #67290

Problem

The native work queue cannot run on GitHub Enterprise Cloud with data residency (for example, https://foo.ghe.com). The JavaScript runtime accepts only the literal host github.com, so it rejects resources on the actual server. We found this while evaluating tools.work-queue for a production queue on foo.ghe.com. We currently run a custom issue-comment ledger there that follows the WorkQueueOps pattern.

Analysis

This analysis comes from reading the source at 7745f43bf7f0ae5e7f2e1dc11e891dff8dff3edb. We did not run the queue on GHE.

The Go code under pkg/ has no host check. work_queue_dependency_resolver.cjs already compares hosts without a fixed value. The work-queue specification does not say whether GHE is out of scope. Related: #41912 passed the enterprise host to the CLI proxy.

Plan

1. Add one helper (for example, expectedGitHubHost() in work_queue_resource_scope.cjs) that returns the hostname of GITHUB_SERVER_URL, or github.com when the variable is unset.
2. Replace the literal "github.com" comparisons at work_queue_graph.cjs:21, work_queue_resource_scope.cjs:39 and :90, and work_queue_policy.cjs:108 with that helper.
3. In work_queue_effect_resource.cjs:40, always set target.host = expectedGitHubHost().
4. Document in docs/src/content/docs/reference/work-queue.md that resource host must equal the server's host.

Acceptance criteria

• With GITHUB_SERVER_URL=https://contoso.ghe.com, resources with host contoso.ghe.com pass validation, and resources with host github.com are rejected.
• With GITHUB_SERVER_URL unset or https://github.com, the current behavior is unchanged.
• work_queue_graph.test.cjs, work_queue_resource_scope.test.cjs, and work_queue_policy.test.cjs cover both cases.

If GHE is intentionally out of scope for the work queue, please state that in reference/work-queue.md instead.