Opt-in `opaque-origin` on `<hyperframes-player>` to drop `allow-same-origin` for untrusted `srcdoc`

[valeriangalliat]

Problem

<hyperframes-player> always sandboxes the composition as allow-scripts allow-same-origin. That is correct for Studio, editors, and mobile parent-media (iframeElement.contentDocument).

Hosts that put untrusted HTML in srcdoc (LLM-authored compositions) then share the parent origin. Composition JS can read the host DOM/cookies. 0.7 already drives playback over postMessage when contentDocument is null, so unique-origin playback works; there is just no way to ask for it.

Proposed solution

Keep the default. Add boolean opaque-origin / player.opaqueOrigin that drops allow-same-origin (sandbox="allow-scripts" only).

<hyperframes-player srcdoc="…" opaque-origin></hyperframes-player>

player.opaqueOrigin = true // set before src / srcdoc

Constructor must read the attribute before the first navigation: upgrade callbacks fire in attribute order, so <hyperframes-player srcdoc="…" opaque-origin> would otherwise load same-origin once.

Playback stays on the existing postMessage bridge. iframeElement.contentDocument is null. Mobile parent-media does not apply.

Alternatives considered

• Flip the default — breaks Studio / documented contentDocument / parent-media. No.
• Host wraps the player in another opaque iframe — breaks el.seek() because the custom element is no longer on the page.
• Host forks the player — works, but every embedder of untrusted srcdoc reinvents it.

Additional context

Happy to open a PR if this shape is wanted. Not proposing a default change.