Warn on unsupported external URL host wildcards

External-link manifests accepted host wildcard patterns such as https://*.example.com/*, but runtime matching treated them literally, leaving those grants ineffective and host-send denials silent. This change adds advisory startup and trace warnings while preserving authorization semantics, forwards manifest external-link policy into generated TypeScript runners, and documents the exact URL-pattern grammar with focused runtime, manifest, runner, and JSON/ZON smoke coverage.