feat: adopt icp.net as the mainnet HTTP gateway domain (icp-cli v1.0.0)

[marc0olo]

Summary

Resolves #224. icp-cli v1.0.0 changed the default mainnet HTTP gateway from icp0.io to icp.net (browser canister access is now https://<canister-id>.icp.net and raw.icp.net). This reconciles the skills with the developer-docs change (mirror PR open there).

Changed → icp.net (gateway / browser canister-access URLs)

File	What changed
asset-canister	mainnet access-URL table, certified/raw serving domains, browser-open URL; plus the Node.js HttpAgent host changed from the legacy ic0.app access domain to the canonical API endpoint icp-api.io (the rest of the corpus already uses icp-api.io as the agent host)
custom-domains	default access URL, .well-known/ic-domains fetch URLs, and the custom-domains/v1 REST API host (issue confirms it resolves on icp.net)
certified-variables	mainnet curl example
deploy-to-cloud-engine	frontend canister access URL
internet-identity	illustrative frontend_origins / TRUSTED_ORIGIN examples

custom-domains HttpAgent host guidance

Pitfall 8 and the HttpAgent Configuration section are corrected: a recent @icp-sdk/core HttpAgent resolves an omitted host to https://icp-api.io on a custom domain, so you do not need to set it. The guidance now warns against the real mistake — pointing host at your custom domain / window.location.origin, which is the gateway and does not serve /api/v2. Scoped to the mainnet custom-domains service only.

Kept (NOT the gateway)

• API / agent hosts stay icp-api.io — icp.net is gateway-only.
• Named dapp domains (nns.ic0.app) in icp-cli and agent-web-identity.
• II delegation rewriting pitfall (internet-identity): II still rewrites icp0.io → ic0.app at the protocol level (per the II spec — unchanged by the gateway rename), so this behavioral claim is left as-is rather than turned into a meaningless "icp.net vs icp.net" statement. This is the caveat the issue flagged.
• icp-cli and agent-web-identity SKILL.md needed no changes (only API host + named dapp domains).

Evals

• Updated custom-domains API-endpoint assertions and the asset-canister mainnet-host behavior to match the domain change.
• Updated the custom-domains "HttpAgent host configuration" case to match the corrected host guidance.
• Added an asset-canister regression guard: the mainnet browser URL must be <id>.icp.net (not ic0.app/icp0.io/icp-api.io).
• The internet-identity rewriting eval is intentionally left referencing icp0.io/ic0.app since the pitfall it tests is unchanged.

Eval results (new/changed cases)

asset-canister — "Mainnet browser-access domain is icp.net": WITH 3/3
  ✅ Gives the URL as https://<canister-id>.icp.net
  ✅ Does NOT use the legacy ic0.app or icp0.io gateway domains
  ✅ Does NOT use icp-api.io (that is the API endpoint, not the browser gateway)

custom-domains — "Domain registration API": WITH 4/4
  ✅ Uses the validate endpoint: GET https://icp.net/custom-domains/v1/app.example.com/validate
  ✅ Uses the registration endpoint: POST https://icp.net/custom-domains/v1/app.example.com
  ✅ Uses the status check endpoint: GET https://icp.net/custom-domains/v1/app.example.com
  ✅ Does NOT invent non-existent API endpoints or parameters

custom-domains — "HttpAgent host configuration": WITH 3/3
  ✅ Identifies that the custom domain serves only the HTTP gateway, not the /api/v2 API endpoint, so host must not point at it
  ✅ Says to leave host unset (defaults to https://icp-api.io on a custom domain) or set it explicitly to https://icp-api.io
  ✅ Does NOT recommend setting host to the custom domain or window.location.origin

npm run validate → all 26 skills pass.

Closes #224

[github-actions]

Skill Validation Report

Project Checks

WARNINGS (1):
  ⚠ certified-variables/SKILL.md: missing evaluations/certified-variables.json — see CONTRIBUTING.md for evaluation guidance

✓ Project checks passed for 5 skills (1 warnings)