[alpha_factory] Fix Insight worker bootstrap under strict CSP

[MontrealAI]

Motivation

• The static demo was failing to start under strict Content Security Policy with repeated console errors: Refused to execute inline script and postMessage target-origin mismatches caused by opaque sandboxed iframe origins.
• These CSP-blocked inline iframe bootstraps caused the Playwright readiness check to time out and prevented the docs/site verification from completing.

Description

• Replace the iframe-blob worker bootstrap with a direct module Worker by updating insight_browser_v1/src/utils/sandbox.ts to call new Worker(url.toString(), { type: 'module' }).
• Remove the dynamically-generated inline iframe script and associated message-routing/cleanup logic so the demo no longer depends on inline script hashes or nonces.
• Add a short explanatory comment in sandbox.ts describing the CSP rationale for preferring direct module workers.

Testing

• Attempted npm ci in alpha_factory_v1/demos/alpha_agi_insight_v1/insight_browser_v1, but the install failed in this environment because the package enforces Node.js >=22 while the runner has Node 20.19.6, so full JS build/tests could not be executed here.

---

Codex Task