feat: remove allow-same-origin for better security.

[knightedcodemonkey]

• closes Remove preview iframe allow-same-origin with diagnostics and auto-render performance parity #67

[Copilot]

Pull request overview

This PR tightens preview iframe isolation by removing allow-same-origin and migrating the preview runtime bootstrapping from parent-driven contentDocument mutation to a srcdoc + postMessage protocol, while also adding telemetry hooks and caching to preserve diagnostics/performance.

Changes:

• Replace same-origin iframe execution with a srcdoc bootstrap shell and a parent/iframe messaging protocol + reusable “bridge”.
• Switch workspace virtual modules from Blob URLs + import-map wiring to cached data: module URLs with import specifier rewriting.
• Add preview telemetry events and an E2E assertion that the iframe sandbox blocks parent storage access.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/modules/render-runtime.js	Uses the new iframe bridge, adds preview telemetry, and adjusts auto-render debounce behavior.
src/modules/preview-runtime/virtual-workspace-modules.js	Introduces caching + rewrites imports to produce data: module URLs instead of Blob URLs/import-map entries.
src/modules/preview-runtime/iframe-preview-protocol.js	Adds a versioned message envelope and helpers for validating preview protocol messages.
src/modules/preview-runtime/iframe-preview-executor.js	Replaces parent contentDocument bootstrapping with srcdoc shell, removes allow-same-origin, and implements the bridge + protocol handling.
src/modules/preview-background.js	Removes direct iframe DOM access and forwards background-color changes via callback.
src/app.js	Wires preview background color changes into the render runtime bridge update method.
playwright/rendering-modes.spec.ts	Adds E2E test verifying sandbox isolation and inability to read parent localStorage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.