fix: restrict runtime and playground message dispatch

[jrusso1020]

Runtime and SDK playground messages currently index ordinary objects with message-controlled action names. Names such as __proto__ and hasOwnProperty can select inherited values and throw instead of being ignored. The playground also accepts messages from unrelated windows, allowing them to change preview selection, timing, and edits.

This change closes the related message-dispatch boundary:

• fix(cli): bypass stale cache on tag-based registry lookup #648: use a Map for registered core control handlers, preserving the existing parent/self sender policy and every supported action.
• feat(registry): add experimental HTML-in-canvas launch blocks #611: require a string message type and an own entry in the playground handler table before dispatch.
• feat(cli): add remove-background command for transparent video #612: accept playground messages only from the current preview iframe's non-null contentWindow. Replaced frames, unrelated windows and null senders are rejected before inspecting payloads.

Validation: 2,704 core tests and four playground tests pass; both new regression tests fail the prior implementation. The playground test exercises the real registered UI listener with current/replaced frames, inherited names and non-string coercion attempts. A real Chromium check confirms preview duration messages work while self/sibling and inherited/coerced types are ignored without exceptions. Core and playground typechecks, full workspace build, final core rebuild, lint/format and signed hooks pass.

No alert dismissals are requested. Verify the three PR-ref results and then main CodeQL closure after merge. Payload validation beyond the existing message contract is unchanged.

[miguel-heygen]

Reviewed exact head 7c12a68285ecdb61dd424734992f3d1305adacbd.

packages/core/src/runtime/bridge.ts:57-90,135 follows the CodeQL recommendation directly: the fixed action registry is a Map, so inherited names cannot resolve, while every supported control remains registered. The existing parent/self sender gate still runs before payload/action inspection.

packages/sdk-playground/src/main.ts:1359-1365 independently enforces the playground contract: it resolves the current iframe on every event, rejects null/replaced/foreign senders, requires a primitive string type, and checks an own registered handler before dispatch. The sandboxed srcdoc bridge remains the sole intended sender; supported click/deselect/drag/duration/time actions are unchanged.

Verification: core bridge tests pass 34/34 locally; changed-file oxlint/oxfmt and git diff --check pass. The playground test could not run in the isolated worktree because Vite denies the shared GSAP symlink outside its filesystem allowlist, so I relied on the passing hosted playground/full Test lanes for that surface. Both unrelated hosted timeouts passed on unchanged-head retry. All eight required checks, Windows, full Test, viewport, regression shards, and exact merge-ref CodeQL analysis 1749532267 are green with zero open PR-ref alerts. #648/#611/#612 are code-fixed; no dismissals.

— Magi

Verdict: APPROVE
Reasoning: Both dispatch tables now enforce explicit ownership and the playground authenticates the live iframe before any side effect, while all native gates are green at the reviewed head.