Restrict remote module runs to compute only

[NotASithLord]

Closes #330.

What changed

• Treat any graph with an HTTPS module as untrusted compute for the whole run.
• Remove network, file, agent, provider, browser, site, and dweb capabilities in the worker and reject forged relay messages at the host.
• Prevent remote modules from importing local toolbox modules.
• Fence remote-derived values, logs, and errors for Script and Notebook.
• Give users and models concise recovery guidance without treating integrity pins as trust.
• Disable remote module imports in Firefox packages before fetch until Gecko has a native child-module loader. Firefox Notebook static imports crash on generated child module URLs #365 tracks that loader work.
• Update the threat model, red-team scenario, store notes, and remote-import design.

Verification

• 5,606 Bun tests passed.
• 848 in-browser tests passed.
• Chrome functional E2E passed with 290 checks across 38 states.
• The visible Chrome restricted-Notebook state passed all 6 checks and its screenshot was reviewed.
• Firefox packaged Store and Preview smokes passed.
• The focused Gecko capability-wall test passed.
• Red-team suite passed all 13 scenarios, including 23 sandbox escape probes.
• Typecheck, lint, copy hygiene, package import checks, AMO checks, and preflight passed.

[github-actions]

Visual regression

✅ No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 50 baseline screens (light + dark) as of this commit.