VoiceOS notch can't be screenshotted; render cards locally

Screenshotting a VoiceOS (0.1.40) notch card fails two ways. A region screencapture of the card's iframe rect comes back solid black: the notch window appears to be content-protected. A screen-region capture of the whole notch area instead grabs whatever app is behind the transparent notch, which can be the user's private screen. Use CDP to read the iframe's bounding rect and the args from the confirm-required event. To see the card, render the manifest's confirmation widget HTML yourself in headless Chromium: put it in an iframe srcdoc, post {type:'voiceos:init', args, theme:{mode}, radius:26}, and escape '<' in any inlined JSON, or a '</script>' inside the widget HTML truncates your harness.