[P0][WEB-01] Isolated Chromium embedding

Parent: #1

## Objective
Provide production-grade legacy web compatibility without making remote web content part of the trusted application runtime.

## Scope
- CEF/Chromium worker/process boundary and minimal audited Rust FFI.
- Window/surface embedding, navigation, crashes, renderer lifecycle and source/origin identity.
- Separate browser profiles/partitions; no privileged shell bridge exposed to pages.
- Authenticated private control channel owned by browser host, not remote JS.
- Browser engine version reporting and security-update hooks.

## Acceptance criteria
- [ ] Remote content cannot invoke privileged native APIs or shell IPC.
- [ ] Renderer/browser-worker crash preserves trusted shell/workspace state.
- [ ] Origin/account identity is available to trusted UI and action verification.
- [ ] Debug/control interfaces are inaccessible from ordinary pages/local network.
- [ ] CEF version/update process is automated enough for emergency security patching.
- [ ] Integration spike proves text input, focus, accessibility and GPU rendering on target OS.

## Dependencies
- CORE-01
- SEC-01

**First phase:** P0
**Maturity target:** P1
**Workstream:** Conventional browser and compatibility

Start by reading the CORE-01 and SEC-01 dependencies, then map the CEF/Chromium worker boundary and minimal Rust FFI described in the scope. Validate the integration spike on the target OS, including text input, focus, accessibility and GPU rendering, while checking each acceptance criterion for isolation, crash recovery and update handling.

Written by the indexing model from the issue text.