Make the sandbox frame actually run, and survive a reload

[jwaldrip]

Two things, both surfacing as a blank frame on an HTML relic.

1. The sandbox script was never running

The frame is given sandbox="allow-scripts allow-popups allow-forms" with no
allow-same-origin, which is the point: its document lands in an opaque
origin. Every request that document makes is therefore cross-origin with
Origin: null.

sandbox.html linked its handler as <script type="module" src="/assets/sandbox.js">.
Module scripts are fetched with CORS semantics. The asset carried no
Access-Control-Allow-Origin, so the browser refused it.

Verified against the deployed sandbox rather than inferred: with a listener
attached in the parent and the frame reloaded, relic:sandbox-ready never
arrives. The console is empty, because the failure lives in the frame's origin
and not the page's.

$ curl -sD- -H 'Origin: null' .../assets/sandbox.js | grep -i access-control
(nothing)

Fix: inline the bundle into the page at build time. Relaxing CORS on the
asset would fix the symptom by making the sandbox origin serve something
cross-origin, which is precisely the property the sandbox exists to remove. An
inline script fetches nothing, so there is no request to block and no header
anybody can regress later. The sandbox page's CSP has no script-src, so
inline runs.

Guarded at both ends: the build fails if the expected tag is missing (which
would silently ship the linked version), and the deploy asserts the served page
contains the handler and links no script.

2. A reload lost the key

Reading the fragment strips it from the address bar. That is worth keeping, but
it meant a refresh landed on a dead page telling the reader to go find the
original link.

The key is now remembered in local storage on the service origin, keyed by
relic, until the relic expires. It is written only after a successful mint, so
a key for a relic that does not exist is never stored; dropped when the relic
turns out to be expired, removed, or never published; and dropped when a
remembered key fails to parse, so corrupt storage cannot wedge the page.

Storage that is absent or throws — private browsing, quota, embedded webview,
blocked site data — degrades to doing nothing, which is exactly the behaviour
that existed before. Reads sweep every expired entry, not just the one asked
for, so storage does not accumulate keys to relics that stopped existing.

This changes who can open a relic. For as long as an entry lives, anyone
using that browser profile can reopen it without ever having been sent the
link. /policy now states that, including that clearing site data removes
them.

Verification

• 456 tests pass, up from 439
• 12 on the vault: expiry, sweep-on-read, corrupt entries, leaving other keys
  alone, and both degradation paths
• 5 on the reload flow end to end, including that a dead relic evicts the
  remembered key and that a corrupt one is dropped rather than retried
• built sandbox.html confirmed to contain the handler inline and no src=
• biome, tsc clean