Part of Plan: a very secure browser in Seed (0.5). The pane uses the webview tag, which forces webviewTag on in every app window. Move it to a main-process-owned WebContentsView so the app renderer holds no web view privilege, and navigation, permissions and lifetimes are handled in one place. The existing Electron end-to-end test must pass unchanged in behaviour, and webviewTag is off everywhere.