LPX-602: route listener rule on domain, not apex

[stevethomas]

Hey, I made a thing! 🥳

LPX-602

What problems are you solving?

SyncListenerRuleStep built its host-routing list from Manifest::apex() regardless of whether domain differed. When apex and domain are explicitly different (subdomain canary, vanity zone case) the listener rule matched the wrong host and the canary's own traffic got 503'd by the listener's default action.

Repro:

apex: codinglabs.com.au
domain: fargate.codinglabs.com.au

• DNS: fargate.codinglabs.com.au → Fargate ALB
• ALB receives request, Host: fargate.codinglabs.com.au
• Listener rule matched [codinglabs.com.au, www.codinglabs.com.au] — neither equals the actual Host header
• Default listener action returns 503 "No application matched the host header"

Greenfield bug — alpha never implemented listener rules (EC2 + CodeDeploy did host routing inside Laravel). The only tested path in PR #25 was domain == apex (where apex defaults to domain).

Fix:

SyncListenerRuleStep::routedHosts() (new public static):

• Routes apex + www.apex when domain matches apex (today's single-tenant behaviour)
• Routes the literal domain only when apex and domain differ (subdomain canary / vanity zone)

The pure helper is extracted so 4 unit tests pin the four shapes (apex-only, domain==apex, subdomain canary, tenant-style subdomain).

Is there anything the reviewer needs to know to deploy this?

• Existing single-tenant deploys see no change — Manifest::apex() still defaults to Manifest::get('domain') when no explicit apex: is set, and domain === apex selects the same apex + www.apex host list as before.
• Unblocks the codinglabs.com.au → fargate.codinglabs.com.au Fargate canary and the LPX-599 vanity DNS zone work (both rely on apex ≠ domain).
• 97 pest, 0 phpstan, pint clean.

🤖 Generated with Claude Code