Preserve same-origin iframe WindowProxy through navigation and document replacement #399

Problem

Unchanged Code OSS creates the Markdown/webview content iframe, navigates it to ./fake.html?<id>, subscribes to DOMContentLoaded through the already-obtained contentWindow, then calls contentDocument.open()/write()/close() to install the real document (vendor/vscode/src/vs/workbench/contrib/webview/browser/pre/index.html:1019-1066).

On exact WebScene main 9378075872bf1a5ebf66a1b1a194bd5cbc5e0614, a native reproduction times out after the fake document loads: the listener registered on the initial frame window never observes the navigated document (lifecycle=0). Chrome 153 completes the sequence and preserves WindowProxy identity.

Focused scope

• Keep one same-origin iframe WindowProxy identity across the initial about:blank to admitted src navigation.
• Retain a pre-navigation DOMContentLoaded listener and dispatch it with the navigated contentDocument as target.
• Support open()/write()/close() on that navigated document so Code OSS can replace fake.html with the supplied Markdown/webview document.
• Retire navigation listeners, old document/realm handles, and queued lifecycle work when the iframe is removed or replaced.

Security boundary

Keep existing sandbox and same-origin admission checks fail-closed. This leaf does not add cross-origin WindowProxy access, relax CSP/origin/resource admission, change stylesheet/CSSOM behavior, or cover general history/traversal/reload.

Acceptance

• A Chrome/WPT-derived contract covers WindowProxy identity, event target, fake URL, document replacement, and post-replacement identity.
• Native reproduces the pre-fix timeout and passes the same assertions after the fix.
• Unchanged Code OSS Markdown prelude reaches the post-document.close() marker.
• 100 create/navigate/write/remove cycles leave no stale frame listener/task/document handles and stay within a bounded heap/RSS budget.
• A 1 MiB replacement payload has bounded completion latency and streaming/copy behavior is measured without weakening resource admission.

Parent: #267
Epic: #264
Program: #227