Isolation-clean frontend: delete dead JS, guard listeners, leave shared DOM

- Delete 7 dead-squat widgets (registered UI only for other packs' nodes:
  UniRig/SAM3D/Mocap/FBXPreview/BVH/pointcloud) + their 6 orphaned viewer
  HTMLs + the entire unused js/viewer tree (21 files, imported by nothing;
  only ui/styles.css survives) + unused utils barrel.
- Rename namespace geompack -> geometrypack (= DisplayName, lowercased);
  all 17 surviving extensions now geometrypack.*.
- Add event.source provenance guards to every message listener (2 inline,
  2 factory handlers via new iframe param).
- Stop touching document.body: upload file input stays detached (click()
  works detached in modern browsers); folder autocomplete dropdown becomes
  a manual popover inside the widget's own DOM (top layer escapes canvas
  transforms without shared-DOM appends).

Passes comfy-test's javascript isolation lint with 0 errors.

javascript/js/preview_mesh_batch_render.js

@@ -14,13 +14,13 @@ function toggleWidget(w, show) {
         w.type = w.__gpOrig.type;
         w.computeSize = w.__gpOrig.computeSize;
     } else {
-        w.type = "geompack_hidden";      // unknown type -> not drawn
+        w.type = "geometrypack_hidden";      // unknown type -> not drawn
         w.computeSize = () => [0, -4];    // collapse (cancels the 4px row gap)
     }
 }
 
 app.registerExtension({
-    name: "geompack.previewmeshbatchrender.ui",
+    name: "geometrypack.previewmeshbatchrender.ui",
     async beforeRegisterNodeDef(nodeType, nodeData) {
         if (nodeData.name !== "GeomPackPreviewMeshBatchRender") return;
         console.log(`${TAG} registering for GeomPackPreviewMeshBatchRender`);