rig: move http/https, Playground redirect-host, and SQLite advisory-lock substitutes into the rig for every journey #302

The musician-link-page-onboarding journey (#301) needed three journey-scoped sandbox substitutes that every browser journey on this rig will hit. Move them into the rig itself (generated mu-plugin in run.mjs, like ec-network-domain-ids.php) so journeys stop re-deriving them:

1. http vs https. The sandbox serves http, but ec_get_site_url() and ec_link_page_public_base_url() build https:// URLs, so every cross-site hop (/join, /power cards, editor handoff, Link Page canonical redirects) dead-ends. Answer via ec_site_url_override with each site's real home URL, and downgrade https://*.extrachill.(com|link) in wp_redirect.
2. Playground replaces allowed_redirect_hosts. Playground's platform mu-plugin returns only three wordpress.org hosts, discarding extrachill-network's merge, so every cross-site wp_safe_redirect falls back to wp-admin. Re-merge ec_get_allowed_redirect_hosts() at priority 99. Also file upstream at WordPress/wordpress-playground (the filter should merge, not replace).
3. SQLite has no GET_LOCK/RELEASE_LOCK. Every Link Page create/save fails closed. Rewrite those SELECT GET_LOCK(...) queries to SELECT 1 via the query filter (requests are serialized in the sandbox).

After this lands, delete the duplicates from journeys/musician-link-page-onboarding/sandbox-fixture.php.