Embed workspace: switch DE sections without reloading the iframe (postMessage navigate bridge)

## Problem

In the embedded routing workspace, switching between Decision Engine sections in the sidebar remints a one-time SSO code and swaps the iframe `src`, which **cold-boots the whole DE app** each time (exchange code → load app → render). That flashes white on every section change — it reads as flicker when clicking through sections.

## Proposed fix

Once the DE is loaded and authenticated in the frame, switch sections by telling the DE router to navigate — don't reload:

- **First load / profile change / session expiry:** mint + load (as today).
- **Section switch on an already-live frame:** the dashboard posts `{ type: 'de:navigate', path }` into the iframe; the DE listens and navigates internally — no reboot, no flash.

## Scope

- **decision-engine (website):** add a `de:navigate` message listener that drives the router (origin-checked). Ack via the existing `de:route-changed`.
- **hyperswitch-control-center:** in the workspace, post `de:navigate` when the frame is already loaded (same profile, live session) instead of reminting; keep mint + reload as the fallback (first load, expiry, or when navigation can't be confirmed).

## Caveat

The postMessage bridge is origin-checked, so it is smooth only when both apps are **same-origin** (production). Local cross-origin dev falls back to the reload.

## Related

- hyperswitch-control-center#5553 (the embedded workspace)
- decision-engine#436 (chrome-less embed mode + postMessage contract)

Start with the embedded routing workspace in hyperswitch-control-center and the message listener/router entry point in the decision-engine website. Verify the origin-checked de:navigate flow, the existing de:route-changed acknowledgement, and the reload fallback; done means same-profile section switches avoid iframe reloads while first loads, expiry, and unconfirmed navigation still reload.

Written by the indexing model from the issue text.