Hostile-origin fixtures

Synthetic attacker pages for Engagr staging widget tests. Not a real site.

• sibling — framed by the approved parent's hostile-sibling page
• direct-embed — unapproved parent copying the install snippet