A new app from the template sends Cross-Origin-Opener-Policy: same-origin, and the web spec check asks for it #3399

Apps scaffolded by src/apps/scaffold.ts get the SECURITY header set (nosniff, CSP, Referrer-Policy, HSTS on https) but no Cross-Origin-Opener-Policy, and src/release/webspec.ts does not look for it.

Done:

• [ ] SECURITY in src/apps/scaffold.ts includes cross-origin-opener-policy: same-origin, so every scaffolded response carries it.
• [ ] src/release/webspec.ts adds a finding when an HTML answer has no Cross-Origin-Opener-Policy, in the same shape as the hsts finding (not blocking).
• [ ] test/scaffold-webspec.test.ts and test/forge-webspec.test.ts stay green; a new assertion fails without each change.

Files: src/apps/scaffold.ts, src/release/webspec.ts, the two tests. Do not touch src/http/respond.ts (another issue owns the forge's own floor).

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3415 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.