MetaMask stuck on loading screen in Firefox, no password prompt shown

### What is this about?

MetaMask is stuck in an infinite loading state in Firefox. When I try to open the extension, it does not show the password input field. It's just loading indefinitely.

I checked the browser console using DevTools and found CSP-related errors and LavaMoat security-related logs.

This issue is happening even though both my MetaMask extension and Firefox browser are fully updated.

Since I do not have my secret recovery phrase or private key, I cannot restore the wallet elsewhere. My funds are completely locked unless this issue is fixed.

Environment
- Browser: Firefox (latest version)
-MetaMask Extension: Latest version from addons.mozilla.org
- OS: Windows
- Wallet Access: No secret recovery phrase or private key available
-Issue Severity: Critical (funds locked, access completely blocked)

Steps to Reproduce

1. Open Firefox (latest version)
2. Install MetaMask
3. Try to open the MetaMask extension
4. Observe:
- Loading spinner appears
- No password field is shown
- Cannot interact with the extension
- Console shows errors (see below)

Console Errors

InstallTrigger is deprecated and will be removed in the future. [runtime-lavamoat.js:13371:21](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/runtime-lavamoat.js)
onmozfullscreenchange is deprecated. [runtime-lavamoat.js:13371:21](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/runtime-lavamoat.js)
onmozfullscreenerror is deprecated. [runtime-lavamoat.js:13371:21](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/runtime-lavamoat.js)
Snow detected a new realm creation attempt in MetaMask. Performing scuttling on new realm.
Window moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/background.html
[use-snow.js:23:14](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/use-snow.js)
Snow detected a new realm creation attempt in MetaMask. Performing scuttling on new realm.
Window moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/background.html
[use-snow.js:23:14](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/use-snow.js)
Property eval will not be hardened because it is scuttled by LavaMoat protection. Visit https://github.com/LavaMoat/LavaMoat/pull/360 to learn more. [sentry-install.js:1:750](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/sentry-install.js)

WARNING: Missing strong random number source [sentry-install.js:1:750](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/sentry-install.js)

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'wasm-unsafe-eval'” (Missing 'unsafe-eval') [runtime-lavamoat.js:12237:15](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/runtime-lavamoat.js)

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'wasm-unsafe-eval'” (Missing 'unsafe-eval') [runtime-lavamoat.js:5802:30](moz-extension://381eeeb7-9878-4ae4-b17f-98ccafdf144a/scripts/runtime-lavamoat.js)

Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'wasm-unsafe-eval'” (Missing 'unsafe-eval')

### Scenario

_No response_

### Design

_No response_

### Technical Details

_No response_

### Threat Modeling Framework

_No response_

### Acceptance Criteria

_No response_

### Stakeholder review needed before the work gets merged

- [x] Engineering (needed in most cases)
- [ ] Design
- [x] Product
- [x] QA (automation tests are required to pass before merging PRs but not all changes are covered by automation tests - please review if QA is needed beyond automation tests)
- [x] Security
- [x] Legal
- [ ] Marketing
- [ ] Management (please specify)
- [ ] Other (please specify)

### References

_No response_

Start by reproducing the loading state in Firefox and inspecting background.html alongside scripts/runtime-lavamoat.js, scripts/use-snow.js, and scripts/sentry-install.js, which are named in the console output. Trace which CSP or LavaMoat message prevents startup; done means the password prompt appears in the reported environment, with appropriate regression coverage identified.

Written by the indexing model from the issue text.