v2.0.2

Changed

• Iframe sandbox hardened: Removed allow-same-origin from sandbox attribute, giving script ads an opaque origin for stronger isolation.
• Switched to srcdoc: Script injection now uses iframe.srcdoc instead of doc.open()/doc.write()/doc.close() for cleaner, more reliable content loading.