Context

HTML attachments can now keep useful interactive previews while running in an isolated srcdoc iframe instead of a same-origin attachment frame. The preview uses sandbox="allow-scripts" without allow-same-origin, referrerpolicy="no-referrer", and an injected CSP with default-src 'none'; base, forms, object/embed, nested frames, workers, navigation, and connect-src are blocked, while HTTPS-only scripts, styles, images, media, and fonts remain available for interactive reports.

Previews are loaded only when opened and are disabled for unsafe cases: metadata over 10 MiB prevents fetching, fetched HTML over 10 MiB is rejected before rendering, and invalid HTML falls back to source plus download when the source is at most 2 MiB. Inline preview height now follows the attachment content through a sandbox-to-parent resize message with frame/source validation, per-preview tokens, and a visible height clamp from 320px to 1600px with a 480px initial height.

fixes #706

Checklist

• Sign Allure CLA
• Provide unit tests