Support panel hosts that serve the page from their own scheme

Codex serves panels from codex-sandbox:// pages, where origins are
opaque: the panel recognizes the app's own addresses by scheme and host,
the vessels feed resolves against the document address, and the dev
server answers Codex's sandbox origins with CORS.

build/vite.js

@@ -6,6 +6,7 @@ import { embedFramingPlugin } from './embed-framing.js';
 export const PANEL_CORS_ORIGINS = Object.freeze([
   /^https?:\/\/(?:(?:[^:]+\.)?localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/,
   /^https:\/\/[a-z0-9]+\.claudemcpcontent\.com$/,
+  /^(?:https|codex-sandbox):\/\/[a-z0-9-]+\.web-sandbox\.oaiusercontent\.com$/,
 ]);
 
 /**