fix(poc-sandbox): namespace segmentation

[kwburns-kong]

What & Why

Builds on Kong#10095, which runs plugin template tags in a QuickJS-WASM sandbox. That PoC
isolates code execution, but a security pass found two gaps: the host bridge still passed
untrusted data through unchecked, and the sandbox's raw host functions stayed reachable on the
global scope. There were also no CPU or memory limits, so a tag could hang the process. This PR
closes those gaps so the sandbox is an actual trust boundary.

Approach

• Namespace segmentation: the host-injected __hostBridge / __crypto* / __hostConsole
  globals are captured into closure locals and deleted from globalThis at the end of the
  bootstrap, before plugin source evaluates. The closures keep the references they need, so plugin
  code can only reach the rebuilt context, never the raw bridge.
• Host-side plugin identity: scopePluginDataHandlers forces the trusted pluginName onto
  every pluginData.* call, so a tag can't forge another plugin's name to read or clear its store.
  Identity comes from the host, never from the sandbox body.
• DoS guards: install a QuickJS interrupt handler (shouldInterruptAfterDeadline) plus a memory
  limit, so a synchronous while(true){} is interrupted within the deadline instead of hanging the
  process. The async driver deadline alone can't catch synchronous loops.
• Bridge boundary hardening: util.render depth cap (capUtilRenderDepth); host error-message
  path redaction (sanitizeErrorMessage); prototype-pollution stripping
  (__proto__/constructor/prototype) on the parsed bridge body; request and response payload
  size caps (maxPayloadBytes, default 8 MiB).

Scope

• Same scope as PoC: run plugin template tags in a QuickJS-WASM sandbox Kong/insomnia#10095: template tags only; sandbox runs in main; renderer→worker→IPC path
  unchanged — only main-side execute handlers and the sandbox internals change.
• templateTagSandboxEnabled stays default-off; legacy path untouched when off.
• require shim still path + crypto only.

Files

• src/templating/sandbox/in-sandbox-bootstrap.ts — capture + delete raw host globals
• src/templating/sandbox/host-bridge.ts — scopePluginDataHandlers, capUtilRenderDepth
• src/templating/sandbox/plugin-tag-sandbox.ts — interrupt + memory guards, prototype-pollution
  reviver, payload caps (maxPayloadBytes option)
• src/templating/sandbox/marshal.ts — sanitizeErrorMessage in encodeBridgeFailure
• src/main/templating-worker-database.ts — compose capUtilRenderDepth(scopePluginDataHandlers(...))
• src/templating/sandbox/{namespace-segmentation,bridge-hardening}.test.ts — new tests

Tests / verification

• namespace-segmentation.test.ts (6): __hostBridge hidden; crypto globals deleted but
  require('crypto') still works; direct bridge call throws; cross-plugin forge overridden;
  synchronous infinite loop interrupted.
• bridge-hardening.test.ts (10): depth-cap unit + end-to-end; path redaction (POSIX/Windows/URL);
  __proto__ stripped without polluting Object.prototype; oversized request/response rejected.
• Full sandbox suite 37 pass (21 parity unchanged + 6 + 10); ESLint + tsc clean on touched files.

Known limitations / follow-ups

• Coverage boundary: only the worker→IPC execute handlers are gated; the in-process render()
  engine (createLiquidTag) and nested util.render still run unsandboxed. The depth cap bounds
  direct self-recursion but depth resets across the ungated engine.
• WASM/dependency supply chain not yet pinned.
• require allowlist still breaks plugins using fs/lodash/axios (inherited from PoC: run plugin template tags in a QuickJS-WASM sandbox Kong/insomnia#10095).