[wieslawsoltes]

The signed, unchanged Code OSS app now loads its isolated Markdown prelude, but the prelude stops because navigator.serviceWorker is missing in its HTTPS child frame. Nested WebScene contexts installed ServiceWorker only when the workbench parent could read the child DOM. Expose the worker API to eligible child origins while preserving parent isolation, and check the owning iframe and ancestor sandbox flags before any child script runs; the previous body-ancestry check missed an opaque sandbox until after attachment. Fixes #892; advances #264 and AppScene#398.

The product-neutral native fixture registers a worker from an admitted cross-origin HTTPS child while the parent still cannot read contentDocument. It denies ServiceWorker in an opaque allow-scripts child and its nested allow-same-origin allow-scripts child. The focused macOS native run passes in 230.711 ms (<1 s); related 100-cycle worker lifecycle p95 6.60546 ms, Clients p95 0.053208 ms, and iframe sandbox gates pass. git diff --check passes. Evidence: docs/validation/isolated-service-worker-child-892-264.md. The exact installed Code OSS package must be rebuilt after merge to qualify the next webview stage; full Markdown is still an open epic gate.

The previous main metadata run and the first PR metadata run both failed the same stale IndexedDB bootstrap byte-digest assertion. The second commit pins that test to the currently merged source bytes (0c9d4e...) without changing the actual bootstrap; its five local portability/digest tests pass. The updated PR head needs a green metadata job before merging.