The dashboard's monaco-adapter computed the target origin from the
iframe's src URL:

  const origin = new URL(frame.src, location.href).origin;
  frame.contentWindow.postMessage(msg, origin !== 'null' ? origin : '*');

In the real extension that resolved to 'chrome-extension://<id>'. But
the editor iframe is sandboxed via manifest.json — it runs in an opaque
'null' origin, not the extension origin. postMessage silently drops any
message whose targetOrigin doesn't match the recipient's document
origin, so every 'set-value' sent from the parent was rejected. Monaco
loaded fine (as of v2.1.1's CSP fix), but the script code never made
it into the editor — users saw a blank editor with no content.

The iframe side already uses targetOrigin '*' (with a comment noting
'sandbox cannot know parent origin'). The parent needs to do the same.
Always post with '*' — the channel is private between the dashboard
page and the Monaco iframe, no external parties are listening.

This bug was masked until v2.1.1 because the previous sandbox CSP
lacked 'unsafe-eval', which kept Monaco from loading at all.