Authenticate the browser Host API

Editor assessment

This commit patches CVE-2026-82533. The patch is described precisely: 'authenticate the browser Host API' names both the action and the surface, the web scope is accurate, and the 43-character header is lowercase, imperative and period-free. What is missing is the body: the message never explains which trust boundary was open or what a malicious page could do with an unauthenticated Host API, so a reader still has to open the diff to understand the risk. For a security fix that is a meaningful gap, but the subject alone is honest and specific enough to scan. Add one sentence about the bypass and this becomes a 4.