fix(player): construct media observer in iframe realm

[jrusso1020]

What

Construct the player's dynamic-media MutationObserver from the observed iframe document's realm, with the global observer retained only as a fallback.

Adds a regression test proving the iframe-realm constructor is used instead of the parent-window constructor.

Why

The dynamic parent-media proxy work introduced in #307 created a parent-window MutationObserver and then attempted to observe iframe-owned DOM nodes. Browsers reject that cross-realm combination in Studio previews, leaving the composition player unable to initialize correctly.

The existing tests used a same-realm synthetic document and spied on the global observer, so they encoded the incorrect ownership assumption.

How

Resolve the observer constructor from doc.defaultView?.MutationObserver before falling back to the global constructor. The regression test supplies distinct iframe/global observer implementations and asserts only the iframe implementation observes the composition host.

Test plan

• Unit tests added/updated
• Manual testing performed
• Documentation updated (not applicable)
• oxfmt and oxlint pass for both changed files
• hyperframes-player.test.ts: 128 tests pass
• Player package typecheck passes
• Verified the affected project loads and scrubs in HyperFrames Studio
• Full player suite in the isolated worktree is blocked by a stale dependency cache missing the newly introduced @hyperframes/parsers/slideshow workspace link; 250 other tests pass

[miguel-heygen]

The fix is correctly scoped and regression-backed.

• packages/player/src/parent-media.ts:412-420 resolves the constructor from the observed document realm, preserves a safe global fallback for detached/synthetic documents, and retains the existing teardown-before-replace lifecycle.
• packages/player/src/hyperframes-player.test.ts:748-778 positively proves the iframe constructor is used and the parent constructor is not.
• Browser E2E on exact head 66239ced: loaded the built player with a real same-origin iframe, installed distinct parent/iframe observer constructors, observed the composition host from the iframe realm, dynamically added timed media and confirmed one proxy adoption, exercised runtime-ready + seek/play/pause controls, then removed the player and confirmed observer disconnect. No browser errors or unhandled rejections.
• Local exact-head verification: hyperframes-player.test.ts 128/128 passed; player typecheck passed; player package build passed. Required CI is green, including Windows, runtime contract, regression, CodeQL, preview parity, and player perf.

Verdict: APPROVE
Reasoning: The implementation restores realm ownership at the correct boundary, keeps fallback and cleanup behavior intact, and is proven both by a focused regression and a real-browser iframe lifecycle run.

— Magi

[miguel-heygen]

Blocker: the native-browser failure mode is not reproduced.

The implementation change is small and realm-local construction is a reasonable choice, but the PR currently asserts that browsers reject a parent-window MutationObserver observing same-origin iframe-owned nodes. I tested that exact case in native Chrome with distinct parent/iframe constructors: new parent.MutationObserver(...).observe(iframe.contentDocument.body, { childList: true }) succeeded, the iframe mutation delivered a callback, and no exception was thrown.

The new unit test proves constructor selection, and the real-browser harness proves the new path observes/adopts/disconnects correctly. Neither demonstrates that the pre-change native path fails. Because this PR is meant to fix a Studio regression, please add or link an exact affected Studio fixture and capture an A/B result on base e7f9918d versus head 66239ced, including the original console exception/stack. If base fails and head passes, that pins the actual contract. If base also passes, the root cause is elsewhere (likely an iframe wrapper/polyfill, stale document across navigation, or initialization race).

History explains the blind spot: the observer was introduced in #307 on Apr 17; the Apr 22 scope tests and later unit coverage all used synthetic/same-realm assumptions and never pinned a native base/head failure.

Verdict: REQUEST CHANGES until the reported Studio failure is reproduced A/B.

Reasoning: The patch is low-risk, but the current evidence validates the replacement path without validating the claimed defect; merging a placebo could leave the actual preview regression unresolved.

— Magi