[davideast]

Lets the live register load the Messaging SDK's packages and lets that SDK's fetch reach Installations and FCM registrations with no pass-through list, ahead of the Messaging rows in M-10 (#2114).

// from packages/cli/test/register/, as live-register-pass-through.test.ts imports it
import { liveEgressRule, passThroughHosts } from '../../src/register/live-net-guard.js';

const fromSdk = liveEgressRule(undefined, { hosts: [], isLiveSdkFile: () => true });
fromSdk('fcmregistrations.googleapis.com', '/');      // null: passes (main: refused as a Google endpoint)
fromSdk('firebaseinstallations.googleapis.com', '/'); // null: passes (main: refused with no list)

passThroughHosts(['firebase/messaging']);     // [] (main: both Messaging hosts)
passThroughHosts(['firebase/remote-config']); // ['firebaseremoteconfig.googleapis.com'] (main: plus Installations)

An app's own fetch to either host is still refused (TypeError: fetch failed), and an https.request to either is refused with a reason that names firebase/messaging.

@firebase/messaging and @firebase/installations are packages the live rows load

LIVE_ROW_SDK_PACKAGES in swap-or-stop.ts gains both. The derived test in live-row-sdk-packages.test.ts now probes firebase/messaging and firebase/messaging/sw too, and the probe resolves exactly those two new packages. The Vite page gate reads the same set, so a file the rows or a pass-through loaded may now import @firebase/installations with no list.

Remote Config still passes through, reaching Installations as a live row host

Remote Config is the other service that reaches Installations. With firebase/remote-config listed, its entry, @firebase/remote-config and @firebase/installations still load from SDK files only, its own host stays caller-checked, and its SDK's fetch to Installations passes while the app's own fetch there is refused. A new test in live-register-pass-through.test.ts covers this. Remote Config's Installations calls stay unobserved, as before.

Risk

• Installations was caller-checked at the socket seams while it was only a passed-through host. As a live row host it passes net/tls from any caller, as the other live row hosts do. The fetch wrapper and the request check still refuse the app's own fetch and http.request. The header comment of live-net-guard.ts says this.
• firebase/messaging still passes through on both planes until M-10 makes it a row. Between this PR and M-10 a listed firebase/messaging loads as before, and its hosts pass as live row hosts instead of as pass-through hosts.
• The case "do not let firebase/messaging admit the firebase/messaging/sw entry" in vite-supplied-rows.test.ts is dropped, as the plan says for M-9. M-10 brings it back as a row case if the gate needs it.

Integration test: none. This change has no runtime path until M-10 serves firebase/messaging as a row, and scenarios reach loopback only, so the production-host verdict stays unit evidence.

Implementation notes

Files (5): packages/cli/src/register/swap-or-stop.ts, packages/cli/src/register/live-net-guard.ts, packages/cli/test/register/live-row-sdk-packages.test.ts, packages/cli/test/register/live-register-pass-through.test.ts, packages/cli/test/serve/vite-supplied-rows.test.ts.

• PASS_THROUGH_HOSTS keeps firebase/functions and firebase/remote-config (its own host). The Messaging, Analytics and Performance entries listed only the Messaging hosts or Installations, which are live row hosts now, so they are gone; passThroughHosts already answers [] for an unlisted specifier.
• http.request to either Messaging host: its own reason and remedy (MESSAGING_REQUEST_REASON, MESSAGING_REQUEST_REMEDY), not the Firestore, Auth and App Check remedy.
• Tests use firebase/functions and firebase/remote-config as the passed-through and unlisted examples, and firebase/remote-config as the alias target.

Tests written first, run against main's code: 6 failures (the package probe lists the two new packages; both hosts refused with no list; a fetch to registrations from an SDK file refused; the https.request refusal had the generic reason; Remote Config's host list still named Installations; @firebase/installations unreachable from a loaded file with only firebase/functions listed). With the change:

bun test test/register/live-row-sdk-packages.test.ts test/register/live-register-pass-through.test.ts \
  test/serve/vite-supplied-rows.test.ts test/register/live-register-stop.test.ts \
  test/register/net-guard-hosts.test.ts test/serve/vite-module-swap.test.ts test/google-endpoints.test.ts
156 pass, 0 fail

packages/live/test/pass-through.test.ts: 11 pass. bun run typecheck in packages/cli: clean. Conformance coupling gate: exit 0 (no engine or registry change).