Fail closed on website bootstrap identity

[cbusillo]

Summary

• Parse the typed web.base.url override inside website bootstrap so Launchplane config-parameter records can drive canonical website identity.
• Select website records by canonical host when possible and fail closed when required visible fields are unavailable or do not persist.
• Add tests for canonical fallback, missing fields, config readback failure, and website field readback failure.
• Document that startup/data workflows verify public website identity fields before reporting bootstrap success.

Verification

• uv run ruff format --check docker/scripts/odoo_website_bootstrap.py tests/test_odoo_website_bootstrap.py
• uv run ruff check docker/scripts/odoo_website_bootstrap.py tests/test_odoo_website_bootstrap.py
• uv run python -m unittest tests.test_odoo_website_bootstrap
• uv run python -m unittest discover -s tests
• uv build

Live context

Launchplane now stores and renders the cm_website testing website bootstrap plus web.base.url override, but the public page still serves localhost canonical and My Website branding. This change makes the runtime helper fail before printing website_bootstrap_applied=true when those visible identity writes do not actually persist.