fix(dom): accept cross-realm pointer events

[bzy-debug]

Summary

• keep the existing same-realm instanceof fast paths for mouse and pointer event casts
• fall back to native Web IDL brand checks so events created by an iframe realm are recognized without accepting lookalike objects
• extend the DOM API browser probe to cover both PointerEvent and inherited MouseEvent conversion for an iframe-created event
• verify that a plain Event is still rejected as both event subtypes

Closes #164

Testing

• moon fmt --check .
• npx playwright test tests/dom-api.spec.ts --project=dom-api-chromium — 11 passed
• CI=1 npm test -- --reporter=list — 126 passed

Formatting note

The current MoonBit formatter also adds a required trailing comma to one pre-existing destructuring pattern in rabbita/top.mbt. That isolated mechanical change is included because the check workflow formats the whole package and requires a clean diff.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T07:29:18.345404Z	6c2b95f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.