Bound nested webview context-menu ancestry and handoff #529

Parent: #268. Webview epic: #264. Release epic: #227.

Proven gap

Unchanged Code OSS handles a nested webview context menu by rejecting an already-cancelled event, preventing its default, walking event.target.closest('[data-vscode-context]') and parent elements, merging child-over-parent JSON context, toggling the visibility class, and posting child-local coordinates. WebScene stores child documents below iframe owners in one retained layout tree, so unbounded DOM ancestry can leak the outer iframe/host document into closest(), event propagation, and composedPath().

Focused implementation

• Bound Element.closest() at the element's browsing-context cascade root.
• Bound native event ancestry and composedPath() at the dispatch realm's document root.
• Preserve the merged nested data-vscode-context contract, prior cancellation, handler cancellation, visibility-class lifecycle, and child-local coordinates delivered by Project host pointer coordinates into nested webview viewports #522.
• Add an exact Code-shaped native right-click regression and a standalone browser/native contract/profile.

Acceptance and deferred gates

• Implementation rebased on WebScene main 9f2d4830728a409ee49449f45eb33bd5d54dabca.
• Focused regression sources authored.
• git diff --check passed.
• Execute Chromium/native contracts and exact unchanged webview acceptance.
• Run lifecycle, performance, memory, and accessibility gates.

Execution is deferred under the current implementation-first direction.