#26286 feat(agent-chat): isolate artifacts on shared WK page host

The shared cmux-page://cmux.agent/ page host now has the isolated artifact-frame contract used by the legacy agent host. PageArtifactFrame serves the exact __artifact endpoint with opaque sandbox allow-scripts CSP, a one-shot render protocol, data/blob-only media, and denial of artifact/srcdoc self-navigation, nested frames, network/file/page/bridge resources.

This is the shared WK fallback prerequisite for #26216; the CEF counterpart is #26224. Shared-page frontend Preview/Run integration belongs to the dependent change. Ordinary page routes remain unchanged.

Leo: "the /side thing i heard somebody really liked in codex... and i think html/html artifacts and that kinda good viewing and good support for it would be cool" / "like the claude.ai artifacts but imagien you didnt need to only have it on claude.ai...".

The interactive-artifacts highlight now links to the NEXT agents documentation. Frozen head: 8f90d5002ab4012ccfccfd668ff160bef4848349.

Validation:

• Five digest tests passed in fleet run 40910011990, on tree b0b0861c1906b2e37aa03ccb6753ded3e7abcee2, identical to the frozen head's tree.
• cmux-next guards 40910554261 passed at the frozen head.
• Independent Astra high whole-diff static review: SHIP at the frozen head (39 files); execution evidence is separate.
• Exact-head fleet daemon step 87cc86b14192f30b669a229a: all six suites passed (CmuxNextDaemonTests, CmuxNextMobileTests, FirstLaunchTests, ClassicImportTests, ClassicMigrationTests, ClassicUpgradeSimulationTests). theFirstLaunchBringsEverythingOnce passed all eight cases, and anOffSSHHostDoesNotHoldBackLocalWorkspaces passed.
• The agent-pane tour passed all three steps; its light/dark stills passed automated privacy checks and manual inspection.

No capture: tour:core reached 20 passing steps, but its final Profile menu step needs a full-display screenshot. The current shared capture driver refuses every display step, including whole-display and Blacksmith captures; driver.py returns an unavailable result before executing the menu action. The exact-head attempt used build 8acc263942485ec43022bad8; the tour was refused and nothing from it was uploaded. This is a capture-driver limitation, not a successful core-tour receipt.

Capture tour-agent-pane at 8f90d5002ab4 (fleet build, capture mini, text checked for private data)

Light	Dark

Agent session: agent session