feat: explore Chrome as WASM sandbox — per-request browser context isolation

[iheitlager]

Summary

Follow-up from #8 (Phase 3). Explore using browser contexts as isolation boundaries for WASM execution — closer to real serverless patterns (Cloudflare Workers, Fermyon).

Tasks

• Explore using BrowserContext as per-request isolation boundaries
• Compare fresh context per request vs context pooling
• Measure isolation overhead vs shared-context approach (leg2b)
• Document security guarantees of browser-level isolation
• Compare with WASI sandbox model (leg3)

Hypotheses to test

#	Hypothesis
H10	Browser context isolation adds measurable per-request overhead but provides security guarantees

Learning goals

• Explore the browser as a compute sandbox (not just a rendering engine)
• Compare Node.js-as-WASM-host vs Chrome-as-WASM-host patterns
• Understand what guarantees BrowserContext isolation actually provides

Depends on

• feat: use Chromium as a true WASM driver — fix Leg 2, add Playwright, explore sandbox isolation #8 (leg2b must exist first as the baseline)

---

🤖 Analysis by Claude