Drag-and-drop follow-up: review fixes

[AllTerrainDeveloper]

Summary

Follow-up to #260 (Drag and drop improvements). Five code-review items from a post-merge audit:

1. console.log → console.info in src/drag/iframe-drop-targets.ts. no-console ESLint config allows info/warn/error only; this drops the inline eslint-disable and uses the more semantically accurate level for the drag-start diagnostic.

2. Mid-file imports in src/desktop-files/layer.ts. buildBridgePayloadFromPlacement had been inserted between two groups of imports, which would have tripped import/first. Moved the function below all imports.

3. Block javascript: / data: / vbscript: URLs in the Gutenberg drop-receiver (src/gutenberg-drop-receiver.ts). Same-origin postMessage is the first line of defence; this is defence-in-depth so a hostile URL surviving into a core/file href or core/paragraph anchor can't become click-to-XSS. Returns null (silent no-op) for hostile URLs — same shape as "empty URL → no insert".

4. Drop site-editor.php enqueue in includes/render/assets.php. The FSE's core/block-editor store isn't reliably available without an opened template in the canvas, so drops would silently time out at the receiver's 5 s waitForEditor poll. Also added a desktop-mode-drop-failed postMessage from the receiver → parent toast pipeline so any future "editor not ready" failure surfaces as user-visible feedback instead of just a console.error.

5. Map mutation during forEach in the WINDOW_CLOSED cleanup of iframe-drop-targets.ts. Spec-safe but reads as a hazard; switched to for…of over Array.from() snapshots for both _suppressedIframes and _activeRegistrations.

Test plan

• npm run lint clean
• npm run typecheck clean
• npm run test:js — 1485 passing (3 new vitests cover javascript: / data: URL rejection across post / user / attachment payloads, plus the leading-whitespace + uppercase variants)
• npm run build:desktop + npm run build:gutenberg-drop-receiver — clean
• Manual: drag a media tile / post shortcut / wallpaper shortcut into an open Gutenberg post window; confirm block insertion
• Manual: open Gutenberg, wait, then drag in; confirm no spurious "Could not insert" toast (receiver still works after editor finished booting)

🤖 Generated with Claude Code

[github-actions]

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check