fix(feeds): RSS allowlist drift blocks feed-health activation — war.gov/thenationalnews.com/trumpstruth.org in catalog, missing from allowlist mirrors

[koala73]

Symptom

The feed-validation.yml workflow (now publishing feed-health + recall-benchmark after #4927) exit-1 hard-fails before publishing, so news:feed-health:v1 / news:recall-benchmark:v1 never activate. Manual dispatch run: https://github.com/koala73/worldmonitor/actions/runs/28787529347 — Summary: 635 OK, 13 stale, 13 dead, 17 empty then exit code 1.

Root cause (pre-existing, NOT from the #4919-4923 merges)

3 feeds in the server catalog (server/worldmonitor/news/v1/_feeds.ts) have hosts absent from all 5 RSS-allowlist mirrors, tripping the CONFIG_DRIFT hard-fail (Host not in allowlist):

Feed	Host	Likely cause
Pentagon	www.war.gov	DoD rebrand defense.gov→war.gov; allowlist still has www.defense.gov only
The National	www.thenationalnews.com	added to catalog, never allowlisted
Trump - Truth Social	trumpstruth.org	added to catalog, never allowlisted

The allowlist/feeds files were last touched by #4199/#3986/#3891/#3887/#3885 — this drift predates the news-pipeline program. The #4927 guardrail (publish after the config-drift hard-fail) is working as designed: it correctly refuses to publish health metadata on a drift-failing run. It just means activation is blocked until the drift is resolved.

Fix options (per feed, decide individually)

• Allowlist (feed is wanted + host legit): add the host to all 5 mirrors — shared/rss-allowed-domains.json, shared/rss-allowed-domains.cjs, scripts/shared/rss-allowed-domains.json, api/_rss-allowed-domains.js, and vite.config.ts:RSS_PROXY_ALLOWED_DOMAINS. (SSRF-boundary change — review deliberately.)
• Remove/fix catalog entry (feed stale/unwanted): drop or correct it in _feeds.ts.

war.gov is the official DoD successor to defense.gov; thenationalnews.com (UAE) and trumpstruth.org are live news sources already in the catalog — so allowlisting all three is the likely intended state, but it's a security-boundary edit worth an explicit call.

Verify

Re-run npm run test:feeds:ci locally/CI: the 3 must move out of the Host not in allowlist class (to OK or soft third-party dead), the script exits 0, and feed-health publishes → health endpoints flip pending-activation → monitored.