Hand back the link that carries this browser's goal into the app (#2566).

Guarded exactly like publishing — cookie, CSRF and Origin — because it mints a credential, and refused on an unsettled goal for the same reason publishing is: there is no promise yet to take anywhere.

The link is one static short link with the token in its query, not a link minted per goal. That shape is already proven in production by the channel invite (#858), it survives a deferred install (the store round trip returns the clicked URL with its query intact), and minting per goal would put a vendor API key on this service for nothing.

Idempotent: asking again answers with the same link, so reloading the page never invalidates one the athlete already sent to their phone.