fix(util): also keep Host in header map for synthetic requests

Addressing the P1 note from the Codex reviewer: applyCustomHeaders is
also called with a synthetic &http.Request{Header: ...} from the
websockets executors (aistudio_executor.go, codex_websockets_executor.go),
which forward only the header map. The previous continue meant a custom
Host was dropped from that map, regressing virtual-host overrides on
those flows. Mirror the value to both r.Host (for real net/http) and
r.Header (for header-map-only consumers).

internal/util/header_helpers.go

@@ -47,13 +47,13 @@ func applyCustomHeaders(r *http.Request, headers map[string]string) {
 		if k == "" || v == "" {
 			continue
 		}
-		// Host is read from req.Host (not req.Header) by net/http when
-		// writing the request; setting it via Header.Set is silently
-		// dropped on the wire. Handle it explicitly so user-configured
-		// virtual-host overrides actually take effect upstream.
+		// net/http reads Host from req.Host (not req.Header) when writing
+		// a real request, so we must mirror it there. Some callers pass
+		// synthetic requests (e.g. &http.Request{Header: ...}) and only
+		// consume r.Header afterwards, so keep the value in the header
+		// map too.
 		if http.CanonicalHeaderKey(k) == "Host" {
 			r.Host = v
-			continue
 		}
 		r.Header.Set(k, v)
 	}