fix: harden CodeQL security findings

[tnb1j]

Summary

• replace regex-based and dynamic-dispatch security sinks with bounded parsers, Maps, and explicit allowlists
• validate manual navigation, editor URLs, JSGist messaging, and same-origin DevTools messaging
• repair OffscreenCanvas worker imports and the current OrbitControls proxy contract
• add loader regressions and persistent Puppeteer coverage for manual/editor/worker security paths
• correct stale CDN documentation and code-export URLs for @tnb1j/4js

Verification

• npm.cmd test
  • core units: 1326 passed, 1 todo, 0 failed
  • addon units: 20 passed, 0 failed
  • build, lint, entrypoint parity, brand sync, migration, server integration, manual security integration, tree shaking, and E2E coverage inventory passed
• npm.cmd audit --audit-level=low: 0 vulnerabilities
• git diff --check

CodeQL handling

This PR fixes the actionable findings. Dedicated-worker origin alerts, DevTools classic-script global false positives, and the non-security UUID generator alert will be audited on the post-merge main scan before any dismissal.

[github-actions]

📦 Bundle size

Full ESM build, minified and gzipped.

	Before	After	Diff
WebGL	365.64 86.89	365.64 86.89	+0 B +0 B
WebGPU	679.61 188.59	679.61 188.59	+0 B +0 B
WebGPU Nodes	677.65 188.27	677.65 188.27	+0 B +0 B

🌳 Bundle size after tree-shaking

Minimal build including a renderer, camera, empty scene, and dependencies.

	Before	After	Diff
WebGL	507.69 123.44	507.69 123.44	+0 B +0 B
WebGPU	747.13 201.45	747.13 201.45	+0 B +0 B
WebGPU Nodes	697.48 189.04	697.48 189.04	+0 B +0 B