It seems like the target selection for the web companion only respects the path of the deployment location, not the hostname.
We have our publishing url's set up for dev & qa to go to server-dev.example.com/tags/profile/dev/, while prod goes to server.example.com/tags/profile/prod/.
When I change the target environment from prod to dev -- using the web companion -- the version of utag.js requested is server.example.com/tags/profile/dev instead of server-dev.example.com/tags/profile/dev.
The best way to get this addressed is to contact your Account Manager and let them know so they can escalate the issue appropriately.
You are correct that since the target environment versions have different hostnames, Web Companion will not be able to switch between them. Currently, it can only switch between environments that share a hostname. You should be able to switch between QA and Dev easily, since in your example they share a hostname, but you will have to go directly to the sites that point to server-dev.example.com/tags/profile/qa/ or server-dev.example.com/tags/profile/dev/ to do this.
I needed this functionality again, so I dove in and found that the cookie the companion sets to tell the loader which version to load is actually a path to the utag.js.
So you can set the environment like this (replacing the account and profile in the cookie name):