fix(portal-clis): reject foreign detail URLs in Jobbank and Jobnet (#672)

* fix(portal-clis): validate Jobbank and Jobnet detail URL hosts

* fix(portal-clis): preserve scheme-less portal detail URLs

Normalize host-like input with HTTPS before validating the portal host. Cover apex, www, mobile, uppercase and legacy routes while rejecting foreign or deceptive hosts and query-only posting paths.

Thanks to MadsLorentzen for finding the compatibility regression in #672.

* changelog: place the #672 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -271,6 +271,13 @@ per-file diff commands.
   `x=ok; test "$x" = ok`, Git for Windows' own Bash is tried when the launcher fails the probe, and the
   replay checks skip only when no usable shell is found.
 
+- **Jobbank and Jobnet `detail` reject posting URLs on other hosts** (#672,
+  `.agents/skills/jobbank-search/cli/src/helpers.ts`, `.agents/skills/jobnet-search/cli/src/helpers.ts`) -
+  previously, a matching `/job/<id>` or `/find-job/<id>` path on any website was silently interpreted as
+  a posting on the selected portal. Both CLIs now require an HTTP(S) URL on their own domain and extract
+  the ID from its pathname only. Bare IDs, portal links without a scheme, portal subdomains, and Jobnet's
+  legacy posting routes remain valid.
+
 ### Security
 
 - **CI no longer leaves the job token in `.git/config` or expands a PR-controlled name into a