Implement live Selection and Window.find for nested webviews #405

Reproduction

After #399, unchanged Code OSS 645f29cc3176500b4b5762ba887cf2a7f0ffdf2c reaches the Markdown iframe's active-document setup through its intentional 200 ms load fallback. With enableFindWidget, browser/pre/index.html then handles find by calling:

const selection = target.contentWindow.getSelection();
selection?.collapse(selection.anchorNode);
target.contentWindow.find(value, false, previous, true, false, false, false);

On WebScene 51f71381bda9015b64cf0566534e209f8bfa9986, contentWindow.find is undefined and getSelection() returns a new empty placeholder on each call, without anchor/range state. Chrome 153 exposes a stable live Selection and advances repeated find calls through the document.

Focused scope

• Implement a realm-local live Selection identity for top-level and same-origin iframe windows.
• Implement the Chromium-compatible Window.find subset used by Code OSS: forward/backward, case sensitivity, wrap, whole-word, repeated query, and selection reset through collapse(selection.anchorNode).
• Search connected text content in document order and expose the active match through anchorNode, focusNode, offsets, rangeCount, getRangeAt, toString, collapse, and removeAllRanges/empty.
• Reset selection/search cursors on document replacement, iframe detach, and realm destruction.

Security and collision boundary

Search and selection remain inside the calling realm's current document. Opaque/cross-origin iframe access stays fail-closed through the existing contentWindow boundary. This issue does not add cross-frame search, Shadow DOM traversal, editing commands, focus/input routing, accessibility publication, CSS behavior, File System behavior, or AppScene packaging.

Owned paths are the V8 DOM/window binding and realm/document lifecycle state, focused native browser-DOM tests, and one Chrome contract/profile. #400 owns File System mutation paths; #401 owns stylesheet CSSOM; the AppScene packaging stack owns no paths here.

Acceptance

• Chrome-derived contract covers stable Selection identity, forward/backward, case, wrap, whole-word, repeat progression, miss behavior, and clear/collapse semantics.
• Native unchanged Markdown find and find-stop calls match the oracle inside the replaced iframe document.
• Cross-origin/opaque access remains unavailable; replacement and detach retire selection state and stale text-node handles.
• A deterministic 100,000-text-node search is p95 <= 50 ms after indexing/search preparation; 100 search/replace/detach cycles retain <= 4 MiB heap and bounded RSS with no stale listeners or selection handles.
• Exact-head Linux, macOS, portable V8, native-document, and NativeAOT gates pass.

Parent: #268
Epic: #264
Program: #227