[FROZEN REFERENCE ONLY - DO NOT MERGE] add realm sandbox boundaries and instant code previews

[christse]

Background and Goal

This draft consolidates the realm-boundary sandbox work: trusted Base loading, per-principal SES execution, the iframe compatibility tier, explicit card/template APIs, and volatile Code-mode preview generations. It preserves the Store as canonical card state while preventing user-realm modules from receiving ambient host, credential, loader, service, or DOM authority.

The branch is published now to run the unchanged full Host CI suite. It remains a draft while hosted iframe origin deployment, route-level SES/iframe retainer testing, and visual CSS paint containment are completed or explicitly split into follow-ups.

Where to start

• docs/realm-sandbox-reviewer-guide.md builds the system from threat model through implementation and gives a roughly 20-minute review path.
• packages/host/app/services/realm-sandbox.ts owns policy, runtime selection, explicit template/style projection, cache lifecycle, and volatile preview coordination.
• packages/host/app/lib/realm-compartment-module-runtime.ts is the SES module/component protocol.
• packages/host/app/lib/realm-sandbox-boundary.ts defines the opaque data boundary used by ordinary Host UI.
• docs/realm-sandbox-wip-review-findings.md records the independent review and the implementation response.

Key decisions and non-obvious mechanics

• Sandbox tier is chosen by host policy from canonical module identity and source classification, never by card source or a URL query parameter.
• Base/trusted module identity is shared and immune to user-realm invalidation; user runtimes are isolated by principal.
• Shared-document CSS is browser-parsed and fails closed on network-bearing grammar, document-global rules, named layers, and selector targets that lost compiler scope.
• Code preview uses immutable source generations, acknowledgement matching, last-known-good rendering, and bounded source-hash caches so server echoes do not remount locally applied edits.
• A 4,096-principal Chrome soak finishes with zero runtimes, loads, templates, and stylesheets and 0.00 MiB forced-GC heap growth after warm-up. A route-level CDP retainer soak remains.

[github-actions]

Preview deployments

• Host staging preview

• Host production preview

• Boxel UI staging preview

Host Test Results

    1 files      1 suites   2h 27m 21s ⏱️
3 882 tests 3 868 ✅ 12 💤 0 ❌ 2 🔥
3 900 runs  3 884 ✅ 12 💤 2 ❌ 2 🔥

Results for commit 3a51b51.

For more details on these errors, see this check.

Realm Server Test Results

    1 files      1 suites   11m 39s ⏱️
2 066 tests 2 065 ✅ 0 💤 1 ❌
2 145 runs  2 144 ✅ 0 💤 1 ❌

Results for commit 3a51b51.

For more details on these errors, see this check.