feat: bounded origin-scoped page bootstrap without native IPC

[zackees]

Refs #195. Coordinated with FastLED/cli#242. Window-options prerequisite #194 is merged; this PR now targets main.

Adds an explicit native-caller WebviewPageBootstrap opt-in (64 KiB UTF-8 source limit, no NUL, validates before copy). The default external-page routes stay script-free. Bootstrap is ordinary trusted caller page JavaScript, not a privileged world or guest ABI capability. Native navigation is restricted to the initial HTTP(S) origin, and wrapped source checks origin and main frame (required because WebView2 ignores Wry main-only injection). Linux installs caller source after removing backend scripts/IPC and before first navigation; Windows/macOS use private Wry document-start scripts. No native IPC, backend API leak, runtime, crate or dependency is added. Script runtime errors and page-side resource use remain caller responsibility.

RED missing API -> GREEN bounds test plus origin/guard policy test. Full GUI-support tests pass (181 library, 4 smoke-helper, integration/doc tests), strict all-target Clippy, formatting, dependency isolation and one-agent review pass. Real Linux Xvfb proof passes: before-page execution on initial load and same-origin reload, absence in a same-origin iframe, absent IPC, required cross-origin rejection and resource cleanup. Original close/title/size/isolation smoke also passes. An initial srcdoc fixture hit the existing non-HTTP navigation policy; using a same-origin HTTP iframe preserves that policy. Linux and Windows CI now run the bootstrap proof.

Windows x86-64 MSVC and macOS ARM64 crosschecks pass; native Windows execution remains required. FastLED adoption, interactive lifetime without arbitrary expiry, Windows zoom/media/render/capture parity, and exact release consumption remain outstanding. App docs checkpoint 741a853 records these gaps; application viewer dependencies are not yet removed.

Windows CI follow-up: the bootstrap fixture failed on an automatic GET /favicon.ico before the iframe request. Commit 46344dc answers only exact favicon GETs within the existing connection/deadline budget; unexpected paths and all proof assertions remain required. Socket regression observed RED then GREEN; all five smoke-helper tests, strict binary Clippy and real Linux native bootstrap proof pass; clud-review is clean. The correction is also merged into the lifetime branch (470f16c). New native Windows CI results remain required.

[zackees]

Resolved the actual cause of missing CI: this branch conflicted with main after the window-options squash merge. Merged main, retaining bootstrap code and importing the already-merged SQLite capability. Reviewer verified the resolution against both parents. Focused smoke fixture tests (5), strict binary Clippy, and real Linux Xvfb bootstrap proof passed. Updated isolation documentation removes the stale private-fork claim. Awaiting CI on this merge head; zero checks are not considered green.