Block direct cross-origin form submission

[NotASithLord]

Summary

• stop direct cross-origin native form submission before click, typing, or submit events
• keep same-origin forms and exact verified login origins working
• return a fixed manual-handoff receipt with no extra prompt
• preserve the pre-effect result through page code and actor boundaries
• update the threat model and red-team probes with the remaining page-script boundary

Review

• adversarial security review: clean beyond the documented page-script residual
• user UX review: quiet manual handoff, no confirmation flow
• model UX review: terminal non-retryable receipt prevents alternate tool retries
• Chrome in-browser: 864 passed
• Bun: 5,643 passed
• typecheck, lint, package preflight, and diff checks passed
• Firefox package and structural parity checks passed; live Gecko remains a CI gate because geckodriver is not installed locally

Closes #269

[github-actions]

Visual regression

✅ No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 52 baseline screens (light + dark) as of this commit.