Storybook postMessage XSS — generic verifier

Proves execution in the TARGET origin via a DOM marker written into the target document, and reports origin-scoped state. No alert(). Read-only: it does not mutate the target.