fix(app): harden preview error responses and verify sandbox messaging

[Richardpwe]

What changed?

Preview resource failures previously returned raw broker and path-validation errors in the HTTP body. Return fixed messages instead, keep detailed diagnostics in the trusted Service Worker console, and return empty error bodies for HEAD requests. Existing 400, 404, and 504 status codes are preserved.

Document the necessary wildcard target origin used to transfer a MessagePort to the opaque preview iframe. Keep sandbox="allow-scripts" and the existing parent, protocol, runner, and session checks.

Related issue or specification

Addresses CodeQL alert 1 (js/stack-trace-exposure). Documents and tests the opaque-origin bootstrap reported by alert 2 (js/cross-window-information-leak).

Checks

• Full npm run release:check: lint, type checking, 6 release-tag tests, 258 unit tests, specification checks, builds, core package smoke test, 12 Chrome tests, and both dependency audits.
• Added 11 Service Worker regression cases covering raw error details, malformed paths, broker failures, HEAD errors, and a successful resource response.
• Added 3 browser tests covering opaque-origin delivery, rejected sibling and replacement connections, and invalid protocol / runner / session commands.
• App version 0.2.3, matching lockfile metadata, and changelog included; validated with scripts/check-release-tag.mjs.
• Preview sandbox permissions preserved.
• No visual UI changes requiring screenshots.
• No private packages, credentials, or licensed assets included.

Notes

After the updated CodeQL analysis, confirm alert 1 is fixed. Alert 2 should be dismissed only with the documented opaque-origin rationale and passing browser-test evidence. No deployment or publishing is included.