Codex review on b21717120c flagged that the previous commit's
``<base target="_blank">`` combined with sandbox flags that omitted
``allow-popups`` silently dropped every link click in the preview --
before that change links at least navigated inside the frame; after
it they were no-ops.
Add ``allow-popups`` and ``allow-popups-to-escape-sandbox`` so a
target=_blank link opens a regular browser tab (rather than an
opaque-origin sandboxed one that most docs sites would render
broken). The popup is then equivalent to the user clicking the same
URL anywhere else. allow-same-origin and allow-top-navigation are
still NOT granted, so the iframe still cannot read parent.document
or navigate the host page.
Test updated to assert the new sandbox tokens explicitly.
fc28f8486b