Wave 2 rollup: spec-conformant MCP Apps host (backs PR #1660)

[cliffhall]

Tracking issue for the Wave 2 rollup PR

Backs #1660 — the web MCP Apps host rollup, combining the eight Wave 2 sub-issues from the #1579 decomposition of PR #1510 into one cumulative PR against v2/main.

• Rollup PR: web: Wave 2 — spec-conformant MCP Apps host (rollup of #1565–#1572) #1660
• Sub-issues (all closed): web: sandbox hardening — opaque-origin inner frame, srcdoc-only delivery, frame-ancestors CSP #1565, web: enforce per-app _meta.ui.csp in the app bridge + surface resource-read failures #1566, web: full hostContext delivery + live host-context-changed updates #1567, web: honor ui/notifications/size-changed and ui/request-display-mode #1568, web: honor ui/download-file with confirmation and http(s) allowlist #1569, web: surface ui/message and app logging in panels below the running app #1570, web: stage partial input — replay tool-input-partial before final tool input #1571, web: app lifecycle status + machine-readable data attributes on the Apps screen #1572

Created so the board tracks the rollup through a real issue card (per AGENTS.md, PRs are not added to the board directly — they are tracked via their linked issue's card).

[cliffhall]

merged