[Error-Zhang]

What changed

• require every iframe-to-host postMessage to come from the mounted iframe's exact contentWindow
• remove the opaque-origin fallback that accepted private bridge message types from an unrelated or missing source
• add regression coverage for the real iframe source, missing and forged sources, opaque origins, and a different iframe
• bump @velaros-ai/html-artifacts to 0.1.1 and regenerate the committed distribution
• add a generated-dist drift gate and immutable release-manifest tooling
• require manual releases from main, with an existing version-matching tag and exact source SHA

Why

Sandboxed srcdoc frames normally have an opaque null origin. The previous handler treated that origin plus an unguessable bridge type as a substitute for checking the sender window, so a forged source could reach host callbacks. Sender identity is now a mandatory boundary.

Validation

• npm run release:dry-run
• 13 Node tests passing, including the new source-isolation regression
• TypeScript typecheck
• demo production build
• committed dist drift check
• npm pack dry-run
• release manifest dry-run with full source SHA and tarball SHA-256