OriginAllowedToMakeWebAuthnRequests(http://partner.example) = 3 (kSuccess=0, kInvalidDomain=3)
ValidateWellKnownJSON(http://partner.example, {"origins":["http://partner.example"]}) = 0 (kSuccess=0)

[VULN CONFIRMED] http:// caller authorised for cross-site RP ID via .well-known.
On iOS, PasskeyTabHelper::OnRemoteRpIdValidationCompleted now calls HandleAssertion()
and the victim's passkey is offered to the MITM-controlled http:// page.