[runtime] preserve custom schema hosts in verifier schema checks and add deterministic schema regression test

[GsCommand]

Motivation

• Schema validation in the runtime /verify flow was rewriting/fixing schema URLs too aggressively which broke local or custom schema hosts and made schema tests fragile.
• Add deterministic repo-local coverage for the malformed-receipt path so checks.schema_valid is exercised without relying on external network schemas.

Description

• Update normalizeSchemaFetchUrl in server.mjs to only rewrite CommandLayer hostnames to the canonical https://www.commandlayer.org while preserving other custom/local schema hosts and their scheme. (server.mjs)
• Add startSchemaHost() test helper that serves a local describe receipt schema and a new test schema validation fails on malformed receipt that verifies a valid receipt passes schema validation and that removing result causes checks.schema_valid to become false. (runtime/tests/runtime-signing.test.mjs)
• No protocol/schema fields were changed; this is a runtime-layer behavior and test-only addition to exercise existing verifier logic.

Testing

• Ran npm run check which succeeded (Node syntax check of server.mjs).
• Ran node --test runtime/tests/runtime-signing.test.mjs which passed including the new regression test.
• Ran npm run test:unit which ran all unit tests and passed (all tests green).

---

Codex Task