Bone Flow Editor v1.0.38 Candidate

Fix scope
- #002 Markdown Preview right pane blank regression.
- Removed late iframe.name token handshake.
- Parent accepts messages only from mdPreview.contentWindow and same origin.
- Child accepts source only from parent and same origin.
- postMessage targetOrigin is location.origin, not wildcard.
- #022 built-in runtime remains 1.0.12 with current 9 effects and no cross.

User-side VS Code execution is required before Completed/Frozen.
