Isolation-clean frontend: delete dead JS, guard listeners, leave shared DOM

- Delete 7 dead-squat widgets (registered UI only for other packs' nodes:
  UniRig/SAM3D/Mocap/FBXPreview/BVH/pointcloud) + their 6 orphaned viewer
  HTMLs + the entire unused js/viewer tree (21 files, imported by nothing;
  only ui/styles.css survives) + unused utils barrel.
- Rename namespace geompack -> geometrypack (= DisplayName, lowercased);
  all 17 surviving extensions now geometrypack.*.
- Add event.source provenance guards to every message listener (2 inline,
  2 factory handlers via new iframe param).
- Stop touching document.body: upload file input stays detached (click()
  works detached in modern browsers); folder autocomplete dropdown becomes
  a manual popover inside the widget's own DOM (top layer escapes canvas
  transforms without shared-DOM appends).

Passes comfy-test's javascript isolation lint with 0 errors.

javascript/js/utils/postMessage.js

@@ -182,10 +182,14 @@ export function createViewerManager(iframe, logPrefix = "[Viewer]") {
  * Create an error message handler for iframe errors
  * @param {HTMLElement} infoPanel - The info panel to display errors
  * @param {string} logPrefix - Logging prefix
+ * @param {HTMLIFrameElement} iframe - Only accept messages from this iframe
  * @returns {Function} Event handler function
  */
-export function createErrorHandler(infoPanel, logPrefix = "[Viewer]") {
+export function createErrorHandler(infoPanel, logPrefix = "[Viewer]", iframe = null) {
     return (event) => {
+        // Provenance guard: without it this fires for EVERY pack's iframe
+        // messages in the shared page, not just ours.
+        if (iframe && event.source !== iframe.contentWindow) return;
         if (event.data.type === 'MESH_ERROR' && event.data.error) {
             console.error(`${logPrefix} Error from viewer:`, event.data.error);
             if (infoPanel) {