feat: permit self-preview-builder-collections in deep links

Now that every collection id must parse as a GUID before it reaches a signed Builder API URL
(previous commit), the param is safe to accept from a deep link again. The deny-by-default
allowlist introduced in #9476 had been dropping it, which silently broke the documented
one-click creator flow in docs/unreleased-wearables-emotes-preview.md.

Placed on the always-permitted tier, not the whitelisted-realm one: the documented link carries
no realm (decentraland://?position=100,100&self-preview-builder-collections=<uuid>), so the
whitelisted-realm tier could never serve it. What bounds the exposure: ids are GUID-validated,
the Builder API only serves a collection to its owner or an authorized curator, and the preview
is local - equipping does not publish a profile change.

Verified: Unity 6000.4.0f1 batch EditMode - 0 compile errors, 63/63 tests (AppArgs incl. the new
pinning test, plus the provider GUID-rejection suites).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mikhail-dcl

Explorer/Assets/DCL/Infrastructure/Global/AppArgs/DeepLinkAllowlist.cs

@@ -16,7 +16,8 @@ namespace Global.AppArgs
     ///         <item>
     ///             <b>Always permitted</b> — benign navigation / share / login intents whose worst case is already
     ///             gated elsewhere (a consent prompt, a matching login token, or a plain coordinate): realm,
-    ///             position, community, signin, authRequestId, force-open-backpack, spawnpoint.
+    ///             position, community, signin, authRequestId, force-open-backpack, spawnpoint,
+    ///             self-preview-builder-collections.
     ///         </item>
     ///         <item>
     ///             <b>Permitted only for a whitelisted realm</b> — the local-development params Creator Hub and the
@@ -76,6 +77,14 @@ public static class DeepLinkAllowlist
             // POSITION — it only picks where inside an already-permitted realm/position navigation the user arrives,
             // with no capability, infra, or exec impact.
             AppArgsFlags.SPAWN_POINT,
+
+            // Builder collection ids to preview unreleased wearables/emotes with. This is the documented one-click
+            // creator flow (docs/unreleased-wearables-emotes-preview.md), and a deep link carries no realm, so the
+            // whitelisted-realm tier below could not serve it. Three properties keep it in this tier: every id must
+            // parse as a GUID before it reaches a URL (BuilderCollectionIds.IsValid), the Builder API itself only
+            // serves a collection to its owner or an authorized curator, and the preview is local — equipping does not
+            // publish a profile change.
+            AppArgsFlags.SELF_PREVIEW_BUILDER_COLLECTIONS,
         };
 
         // Local-development params Creator Hub / sdk-commands attach to preview deep links. Permitted ONLY when the

Explorer/Assets/DCL/Infrastructure/Global/AppArgs/Tests/AppArgsTests.cs

@@ -84,6 +84,18 @@ public void DeepLinkKeepsAllowlistedParams()
             Assert.AreEqual("lobby", output.GetValueOrDefault(AppArgsFlags.SPAWN_POINT), "spawnpoint must survive (named scene spawn point #9369)");
         }
 
+        [Test]
+        public void DeepLinkKeepsSelfPreviewBuilderCollections()
+        {
+            // The documented creator flow carries no realm (docs/unreleased-wearables-emotes-preview.md), so this has
+            // to survive on the always-permitted tier rather than the whitelisted-realm one.
+            Dictionary<string, string> output = ApplicationParametersParser.ProcessDeepLinkParameters(
+                "decentraland://?position=100,100&self-preview-builder-collections=a2041268-189e-4cef-902d-70272aed077c");
+
+            Assert.AreEqual("a2041268-189e-4cef-902d-70272aed077c", output.GetValueOrDefault(AppArgsFlags.SELF_PREVIEW_BUILDER_COLLECTIONS),
+                "self-preview-builder-collections must survive without a realm; ids are GUID-validated before reaching a URL");
+        }
+
         [Test]
         public void DeepLinkKeepsLocalSceneForLoopbackRealm()
         {