bug: Safari/WebKit event.source identity mismatch in sandbox.ts relay breaks PostMessageTransport

Problem

In examples/basic-host/src/sandbox.ts, the relay compares event.source to inner.contentWindow to validate that incoming messages originated from the sandboxed iframe. On Safari (WebKit), this comparison fails because WebKit reports event.source === window (the outer window) rather than the iframe's contentWindow, even when the message genuinely originated from the iframe.

This means the host silently drops all messages from the View on Safari, causing the bridge to never initialize.

Steps to Reproduce

1. Run examples/basic-host in Safari
2. Observe that App.connect() / ui/initialize is sent but the host relay discards it due to the failed event.source check

Expected Behavior

Messages from the sandboxed iframe should be relayed correctly on all browsers, including Safari/WebKit.

Environment

• Browser: Safari (WebKit)
• File: examples/basic-host/src/sandbox.ts

Notes

Originally surfaced in #543. This is a separate issue from the construction-timing race addressed in that PR — it is a WebKit source-identity quirk specific to the sandbox relay, as noted by @ochafik.

Start in examples/basic-host/src/sandbox.ts and inspect the relay's event.source check against inner.contentWindow. Run examples/basic-host in Safari and verify that the App.connect()/ui/initialize messages are no longer discarded. Done means the sandboxed View initializes and messages relay correctly in Safari/WebKit without breaking source validation in other browsers.