Execute and enforce Web Platform Tests

[andrewiggins]

Summary

• execute generated WPT source in a fresh module worker with a new Window from @remote-dom/polyfill
• keep runner results on a private transferred MessagePort and validate every response at runtime
• make the first completion, error, timeout, or cancellation terminal and always clean up the worker
• block worker network connections and nested workers with a worker-specific Content Security Policy
• add the debug UI, canonical capability inventory, Playwright CLI, and dedicated cached WPT CI job

Stacked dependency

This PR is stacked on wpt-runner-input-pipeline, which prepares, contains, serves, and adapts upstream WPT inputs.

Validation

• pnpm run lint
• pnpm run type-check
• pnpm exec vitest run
• pnpm run test:wpt
• classified smoke coverage for runner execution, blocked fetch, and blocked nested workers

Changeset

An empty changeset records that this private test infrastructure releases no public package.

[andrewiggins]

Superseded by the three-PR replacement stack:

1. Source preparation: Add pinned WPT source preparation #630
2. Interactive runner: Add an interactive Web Platform Test runner #631
3. Capability enforcement and CI: Enforce Web Platform Test capabilities in CI #632

The replacement stack gives each PR a self-contained executable outcome. These branches are being preserved temporarily for recovery; this PR is closed without merging.