fix(peek-card): delegate click/focus through shadow DOM boundary
peek-card.click() dispatched on host element but @click handler lives on
inner .card div — event never crossed shadow DOM boundary. Same timing
issue with focus() on initial render before Lit's first paint.
Fix: click() delegates to inner div, focus() awaits updateComplete.
Affects all extensions using activateSelected() (groups, tags, windows).
Also: Scripts extension CSP fix — replace new Function() with Web Worker
blob URLs for script execution, adding worker-src blob: to CSP headers.
108/108 tests pass including new Enter-key activation test.