Add `allowWrite` and `allowExec` options to `api`

Editor assessment

This commit patches CVE-2026-47429. The header announces two new API options, allowWrite and allowExec, and marks the change as a feature under the api scope, which is accurate because it adds capability rather than repairing a defect. What is missing is any body: the defaults for both flags, whether they are enforced in the browser provider or only in config, and the threat model that motivated them are all left unstated. Backticked identifiers are readable, and the trailing PR number is routine. For options that govern write and exec permissions, a sentence on safe defaults would raise this well above the current level. Clear but unexplained.