Add a Block Kit placement for sandboxed content-editor actions

[diogoascarneiro]

Description

In EmDash 0.35, sandboxed plugins can render Block Kit pages, dashboard widgets, and controls for fields inside plugin-defined Portable Text blocks. They cannot add an editor-wide action that reads or updates several collection fields.
BlockResponse can return blocks and a toast, but it cannot return a patch for the open editor form.

This blocks sandboxed marketplace plugins that need an editor-scoped interaction.
For example, a translation plugin should be able to show Translate with provider inside an existing target-locale draft, receive permitted current text fields when clicked, and return translated field values for review.

Expected behavior:

• A sandboxed plugin can declare a Block Kit content-editor placement for selected collections.
• EmDash renders the controls inside a host-owned editor section; plugin JavaScript never runs in the browser.
• On interaction, EmDash sends a constrained current-draft snapshot, entry identity, persisted locale, server-resolved field metadata, and a draft revision through the existing sandbox bridge.
• The plugin may return an editorPatch tied to that draft revision.
• EmDash validates the patch against the collection schema before updating the visible form.
• A stale, malformed, timed-out, failed, or unauthorized response leaves the form unchanged.
• Applying a patch marks the editor dirty but does not directly save it. Existing autosave and explicit save behavior remains unchanged.
• Existing Block Kit confirmation, loading, error, and toast behavior is reused.
• Access to current draft values requires an explicit capability and remains subject to sandbox resource limits.
• The action uses resource-aware content authorization rather than the generic plugin-management permission.

This is separate from adding live-draft methods to trusted React panels. It adds a new host-rendered placement and sandbox transport contract for marketplace plugins.

Documentation:

• Block Kit
• Plugin formats
• Plugin capabilities

Steps to reproduce

1. Configure EmDash i18n with at least two locales and create a collection with multiple text fields.
2. Add a sandboxed plugin with a Block Kit admin route.
3. Use EmDash's existing Translate action to create and open a target-locale draft.
4. Try to declare a Block Kit action inside the content editor that reads several current fields and returns field updates.
5. Observe that Block Kit has no editor-wide action placement and that BlockResponse has no editor-patch response.

Environment

• emdash version: 0.35.0 (3c99225d80a38a9751ed0e4b56e3924e40308e70)
• Node.js version: 22.22.3
• Runtime: Node.js and Cloudflare Workers
• OS: macOS; the missing sandbox contract is platform-independent

Screenshots

Not applicable

Logs / error output

Not applicable. This is a missing plugin extension surface rather than a runtime error.

[MA2153]

Converted this to a discussion as it is a feature request.