mailer/resume-link/digest/kpi templates: bare || env fallback, not a validating resolveSiteOrigin() — commons violation, unverifiable prod origin

Mars has no resolveSiteOrigin(). mailer.ts:21, support-digest.ts:6, resume-link.ts:3, weekly-kpi-templates.ts:72 each use process.env.NEXT_PUBLIC_APP_URL || hardcoded-prod-origin — a bare || default, not a validator. evolutiva-commons §Site Origin requires REJECTING empty/localhost/preview/non-canonical hosts and collapsing to hardcoded prod; the compliant branch only fires when the var is ABSENT, but the var IS SET in Mars prod (Encrypted, unreadable via vercel env ls/pull, server-only so not client-bundle-visible either) — so every outbound email link uses the unvalidated env value with no read path to confirm what it currently resolves to. commons previously said 'Pluto + Mars verified clean'; withdrawn 7d1d12e. Fix: port Pluto's src/lib/site-config.ts shape, repoint the 4 modules. Class-A (email-send path) — needs pre-implementation audit ping + pre-push diff review. Sequencing: audit-mars-ca already holds MARS-576 unpushed; coder-mars-cc re-checks roster before queuing a second Class-A ask.