test(js): lock selectorless runtime contract

Add an explicit runtime guard for root-scoped DOM walks and against selector APIs, preserving the no selector/no hidden client framework boundary.

req: pitch/002

req: runtime/001

req: target_policy/001

slhx-js/tests/runtime.rs

@@ -20,6 +20,22 @@ fn runtime_preserves_multipart_file_upload_fallback_shape() {
     assert!(source.contains("if (body instanceof URLSearchParams) headers[\"Content-Type\"] = \"application/x-www-form-urlencoded;charset=UTF-8\""));
 }
 
+#[test]
+fn runtime_uses_root_scoped_walks_not_dom_selector_apis() {
+    // req: pitch/002 req: runtime/001 req: target_policy/001
+    let source = slhx_js::RUNTIME_JS;
+
+    assert!(source.contains("function firstElement(scope, predicate)"));
+    assert!(source.contains("function closestInRoot(start, root, predicate)"));
+    assert!(source.contains("root.addEventListener(name, (event) =>"));
+    assert!(!source.contains("querySelector"));
+    assert!(!source.contains("querySelectorAll"));
+    assert!(!source.contains(".closest("));
+    assert!(!source.contains(".matches("));
+    assert!(!source.contains("getElementsBy"));
+    assert!(!source.contains("document.getElementById"));
+}
+
 #[test]
 fn runtime_targets_generated_resources_not_response_selectors() {
     // req: target_policy/001 req: target_policy/002