Add bounded nested drag-and-drop routing for Code OSS webviews #539

Parent epic: #268. Release tracking: #264 and #227. Platform authority remains AppScene#32.

Proven gap

The unchanged Code OSS webview prelude forwards drag entry, movement, leave, cancel, and drop through nested frames. WebScene had no typed native ingress or realm-local DragEvent/DataTransfer projection, so preview/custom-editor drop interactions could not preserve target transitions, cancellation, payload lifetime, or navigation ownership.

Scope

• Add a bounded typed native drag ingress for enter/over/leave/drop/cancel.
• Project coordinates and route target transitions through nested documents.
• Publish trusted realm-local DragEvent, stable DataTransfer, FileList, files, strings, and bounded virtual directory entries.
• Require cancellation of the latest dragover before admitting drop.
• Retire sessions and payloads on cancel, navigation, node loss, failure, and teardown.
• Coalesce identical-position dragover work and cap queues/payloads.
• Keep platform filesystem grants and native object authority in AppScene#32.

Bounds

• 64 items
• 64 MiB total file bytes
• 1 MiB metadata/string bytes
• 4 KiB names and relative paths
• 256-byte MIME values
• 1,024 queued worker events

Acceptance

• Focused source implementation and regressions are authored.
• git diff --check passes.
• Focused tests, performance checks, and unchanged Code OSS package acceptance run in the deferred validation lane.

No build, test, benchmark, or formatter was executed under the current fast-merge instruction.