fix(markdown): secure browser document bindings

[George Ng (GeorgeNgMsft)]

Summary

Layer 4 of the replacement stack for #2940.

• validate browser and IPC writes against the active binding token, workspace identity, and content revision
• preserve nested relative paths and isolate same-basename documents with binding-scoped collaboration rooms
• bootstrap browser bindings, correlate live Markdown reads, publish committed snapshots, and evict rotated idle rooms
• keep the Markdown HTTP/WebSocket service on IPv4 loopback and advertise its bound loopback port
• preserve layer 3's headless durable, exactly-once persistence path

Validation

• pnpm run build markdown
• pnpm test in packages/agents/markdown (54 tests)
• focused viewService, urlPath, and markdownUpdatePersistence specs
• Prettier check
• lint, complexity, circular dependency, and debt ratchets against origin/georgengmsft-markdown-durable-updates
• git diff --check

Stack

Base: georgengmsft-markdown-durable-updates (#2968)

The final browser-client serializer/autosave, revision adoption/reconciliation UI, toolbar, and browserPersistence.spec.ts changes remain deferred to layer 5. No src/view/site/** or aiclient changes are included.