Permissions-Policy header not enforced

[XDLCS]

Steps to reproduce

Serve any page with the header:

Permissions-Policy: camera=()

Then via JS/CDP:

navigator.permissions.query({name: "camera"}).then(p => console.log(p.state));

Expected (Chrome 154)

"denied" — the header gates the camera feature.

Actual (moli 1.1.10, 9b2f86b)

"prompt" — identical to the baseline without the header. The header is parsed but the feature gate is never applied.

Suggestion

Apply the parsed Permissions-Policy feature gates to the permissions query pipeline.

Environment

• moli 1.1.10 (9b2f86b), Linux
• Local server with explicit Permissions-Policy header; CDP probe vs Chrome 154.0.8037.57