fix(annotate): scope the framed 404 to embedded-document paths so hosts that iframe the session get the app (#1565)

* fix(annotate): scope the framed 404 to paths that name a file

#1561's catch-all guard fired on every framed request, including the app
document at `/`. The VS Code extension frames the session URL, so an
annotate session opened from the editor rendered "404 Not found" instead
of the app.

One shared predicate (pathNamesEmbeddedDocument / isFramedEmbeddedDocumentRequest
in packages/shared/html-assets.ts, vendored to Pi) now decides it on the
SHAPE OF THE PATH, and the Pi mirror uses it instead of its inline copy.

* test(annotate): pin the framed catch-all matrix in both runtimes

* docs: state the exact framed-404 rule for the annotate catch-all