feat(embed,ui04): E07 acceptance — matrix completion, hostile-CSS hardening, measurements and record closure

- E07 e2e (7 cases): 4-viewport fixed size, narrow shrink + dual-slot 12px stack, single/static + empty state + two-photo loop copies, broken-thumb drop, reducedMotion stop with manual arrows, forged postMessage rejected, hostile CSS (!important box-sizing/border) with inline-important countermeasures + duplicate script dedup
- loader v2: geometry-critical properties upgraded to inline !important (beats host stylesheet !important)
- pre-existing fixes: likes.spec view-count assertion vs concurrent session's AlbumHeader unicode icons (toContainText); embed-v2 host port moved to 3998 (3999 collides with embed-crossorigin under parallel full runs); prettier formatting of two concurrent-session files (formatting-only)
- evidence: matrix EMB-A01..A16 closed in acceptance record (mechanism-level items honestly marked), measurements (loader v2 9885B/gzip 3959B, first-load 1 GET + 1 WS, DOM<=16), refreshed screenshots/recordings, master plan UI-04 note
- regression: root lint/typecheck/test 12 packages green; embed suites 43/43; admin embed-slots 5/5; journey pre-existing env failure reproduced at clean HEAD (registered)

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/embed-loader/src/loader-v2.js

@@ -307,12 +307,15 @@ import {
       ws.position = 'fixed';
       ws.width = V2_WIDTH + 'px';
       ws.height = V2_HEIGHT + 'px';
-      ws.boxSizing = 'border-box';
       ws.borderRadius = '12px';
       ws.border = '1px solid rgba(255,255,255,0.80)';
       ws.boxShadow = '0 4px 16px rgba(15,23,42,0.16)';
       ws.background = '#10161E';
       ws.overflow = 'hidden';
+      // 敌意宿主全局 CSS 反制（EMB-A12：*{box-sizing:content-box!important} 等
+      // 会翻转 195×280 盒模型/给 iframe 加边框）——几何关键属性以 inline
+      // important 压制宿主样式表 important（inline important 优先级最高）。
+      ws.setProperty('box-sizing', 'border-box', 'important');
 
       var frame = document.createElement('iframe');
       // sandbox 同 v1（含 allow-same-origin：iframe 保有项目域源，白名单按
@@ -329,6 +332,10 @@ import {
       fs.height = '100%';
       fs.border = '0';
       fs.display = 'block';
+      fs.setProperty('border', '0', 'important');
+      fs.setProperty('width', '100%', 'important');
+      fs.setProperty('height', '100%', 'important');
+      fs.setProperty('display', 'block', 'important');
       wrapper.appendChild(frame);
       document.body.appendChild(wrapper);