test(js): postMessage targetOrigin gate does not over-drop into frames

Adds regression coverage for the about:blank / empty-origin edge raised in
review on #704: verifies delivery *into* a frame is not broken by the
gate — an explicit matching origin and the wildcard both deliver into a
loaded same-origin frame, the wildcard still delivers to an opaque
about:blank frame, and only a genuine origin mismatch is dropped.

Test-only; no production change.