MCP Apps examples: serve the sandbox proxy from a real second origin

Summary

Give the MCP Apps examples a real second origin for the sandbox proxy, so the spec-compliant path in SEP-1865 is something we run and test, not only something we document.

This is the opt-in half of the #6910 decision. The library default will be an opaque origin with no hosted dependency. The sandboxOrigin option exists for apps that want a genuine cross-origin sandbox, and our own examples are the reference deployment for it.

Why the examples cannot just use public/sandbox.html

Both showcases already contain a public/sandbox.html. It is served from the example's own origin, so a host page at https://<example> loading https://<example>/sandbox.html is same-origin. That demonstrates nothing, and it is the same failure mode as srcdoc with one extra network round trip.

The example needs an origin that is not the example's own. One small static deployment is enough, for example mcp-sandbox.copilotkit.dev, serving a single versioned proxy.html.

Dead code to clean up in the same change

public/sandbox.html is orphaned in both showcases today. Nothing loads it. The only references anywhere on origin/main are one .gitignore line and two CLAUDE.md lines that describe it as required:

examples/showcases/mcp-apps/public/sandbox.html
examples/showcases/generative-ui-playground/public/sandbox.html
examples/showcases/generative-ui-playground/CLAUDE.md:44
  "**CRITICAL**: Requires `public/sandbox.html` ... Without it, iframes show 404."
.gitignore:43  showcase/angular/public/mcp-apps-sandbox.html   (nothing generates this)

#6707 replaced the URL-loaded proxy with srcdoc and left the file and the instruction behind. The instruction is now wrong: the examples render fine without the file. Either point these at the new second origin or delete them, but do not leave a CRITICAL note on a file nothing reads.

Scope

• One static deployment serving a versioned proxy.html on an origin distinct from every example.
• examples/showcases/mcp-apps and examples/showcases/generative-ui-playground set sandboxOrigin to it.
• Delete or repoint the two orphaned public/sandbox.html files and correct both CLAUDE.md entries.
• Drop the stale .gitignore line for showcase/angular/public/mcp-apps-sandbox.html.
• A showcase probe that asserts the widget's window.origin is the sandbox origin and not the host origin.

Acceptance

With the examples deployed, a widget loaded in either showcase must report:

• window.origin equal to the sandbox origin, not the example's origin.
• SecurityError on every attempt to read the host's document.cookie, localStorage, or DOM.
• Its own localStorage working, which is the property the opaque-origin default gives up.

Blocked on the sandboxOrigin option from #6910. Refs #6910, #6707, #6884, #6823.

Start with the sandboxOrigin work in #6910, then inspect the MCP Apps and generative-ui-playground showcase configurations, their public/sandbox.html files, both CLAUDE.md entries, and the stale .gitignore line. Verify how the examples are deployed and how a showcase probe can observe widget origin and storage access. Done means both showcases use a distinct versioned proxy origin, orphaned references are corrected, and the probe confirms the stated origin and isolation behavior.