Pocket modality v2

Part of #591. Membership is carried by the Pocket v2 label and by this issue's sub-issues.

Scope

The full Pocket iteration: users add published cards through a host-controlled deeplink
approval flow, and both the user and the owning product can remove them later. The first
iteration, which permanently displays the privileged cards, is not this.

What has to be true

• A card is declared, not executed: the host renders both the approval dialog and the
  collapsed card without running product code.
• A product cannot add its own card. The user adds one by following a deeplink and
  approving a dialog that shows the card as it will look.
• Both the user and the owning product can remove a card afterwards. Privileged cards are
  always present and nobody can remove them.
• Pocket and Chat share the product's single Worker executable, whose lifetime is a
  reference count across both surfaces.