Expose generic media controls for generated gallery companions and visual iframes

## Problem

Imported content can produce two generic custom-media editing failures:

- Content-sensitive generated gallery companions, including galleries that contain video markup, render a raw HTML preview and expose only an HTML textarea. The generated `CustomBlockGenerator` owns these `custom/gallery-*` blocks.
- `visual-iframe` companions render a bare iframe in the editor and expose no controls for their declared safe attributes.

The gallery failure is not a `responsive-media` conversion path. The solution must preserve `content` as the single sanitized render authority while exposing media-library editing for gallery/video markup.

## Scope

- Add generic author-facing media controls to generated gallery companions, including gallery/video replacement.
- Keep generated non-media custom blocks on their existing generic HTML editing path unless a media classification positively applies.
- Add structured controls for the bounded `visual-iframe` attribute schema and keep its editor preview non-interactive.
- Add public fixtures and contract coverage.
- Prove browser-driven editor select, edit, save, reload, and frontend persistence against a materialized public fixture.

## Related

- #1213 owns canonical companion content rendering, which this must preserve.
- #1483 owns general editor presentation, not companion media controls.
- Automattic/static-site-importer#495 tracks aggregate imported-editor quality. No Static Site Importer packaging change is in scope unless materialization evidence proves one is necessary.

## AI assistance disclosure

The OpenCode orchestrator and the Homeboy OpenCode executor both used OpenAI `openai/gpt-5.6-terra`. They inspected the generator and generated public fixture output, prepared candidate changes and verification, and drafted this issue. Chris Huber authorized and directs the work.

Start by reading the generated CustomBlockGenerator output for custom/gallery-* blocks and the visual-iframe editor behavior, then inspect the public fixtures and existing contract coverage. Done means generic media controls work for classified gallery/video companions, bounded visual-iframe controls remain non-interactive in preview, and browser-driven select, edit, save, reload, and frontend persistence pass against a materialized public fixture.

Written by the indexing model from the issue text.