- Delete 7 dead-squat widgets (registered UI only for other packs' nodes:
UniRig/SAM3D/Mocap/FBXPreview/BVH/pointcloud) + their 6 orphaned viewer
HTMLs + the entire unused js/viewer tree (21 files, imported by nothing;
only ui/styles.css survives) + unused utils barrel.
- Rename namespace geompack -> geometrypack (= DisplayName, lowercased);
all 17 surviving extensions now geometrypack.*.
- Add event.source provenance guards to every message listener (2 inline,
2 factory handlers via new iframe param).
- Stop touching document.body: upload file input stays detached (click()
works detached in modern browsers); folder autocomplete dropdown becomes
a manual popover inside the widget's own DOM (top layer escapes canvas
transforms without shared-DOM appends).
Passes comfy-test's javascript isolation lint with 0 errors.