Gate nested navigation on cancelable beforeunload #577

Parent: #267. Webview epic: #264.

Problem

Nested document navigation and document.open() replacement retired the current realm without first giving its cancelable beforeunload handler a synchronous decision point. A veto must preserve the current document generation, tasks, resource ownership and stable WindowProxy; reentrant same-frame navigation must not corrupt lifecycle state.

Implemented boundary

• Dispatch synchronous cancelable nested beforeunload before iframe src navigation and document.open() replacement.
• Apply the decision before pagehide, generation advance, task retirement and resource teardown.
• Preserve the initiating source, current realm/generation/tasks and stable WindowProxy on veto.
• Guard same-frame reentrant navigation while allowing sibling document work.
• Keep detach non-cancelable.
• Add WPT-shaped/native source contracts, a 100-veto/allowed-navigation source gate and a validation/deferred-work note.

Deferred to #267/#268

Outgoing visibility transition and unload ordering after allowed navigation/discard, reload/history behavior, cross-origin proxy behavior, and cumulative unchanged Markdown/notebook/custom-editor/extension webview acceptance.

Validation boundary

git diff --check passed. Authored contracts were not executed under the current implementation-throughput direction.