fix: let the display worker ignore requests it does not handle

The fetch listener called `respondWith` for every request and re-issued the
unrecognized ones itself. That routes the whole page through the worker,
re-sends request bodies from a different context, and makes the worker's
presence observable on requests it has no interest in.

Classify synchronously and respond only for the shell and artifact URLs this
worker actually owns. Not responding is what leaves the browser doing exactly
what it would have done without a worker at all — which is the property the
allowlist was written to preserve.

Co-Authored-By: Claude Opus 5 <[email protected]>

surfaces/shell/src/display/sw.ts

@@ -1,5 +1,6 @@
 /// <reference lib="webworker" />
 import {
+  classifyDisplayRequest,
   DISPLAY_CACHE_NAMES,
   type DisplayOfflineEnvironment,
   type DisplayOfflineStatus,
@@ -56,14 +57,23 @@ self.addEventListener("activate", (event) => {
 });
 
 self.addEventListener("fetch", (event) => {
-  const handled = handleDisplayFetch(event.request, self.location.origin, environment);
+  // Classified synchronously, and `respondWith` is called **only** for what this worker actually
+  // handles. Answering every request — even by re-issuing it — would route the whole page through
+  // the worker, re-send request bodies from a different context, and make the worker's presence
+  // observable on requests it has no interest in. Not responding leaves the browser doing exactly
+  // what it would have done without a worker at all.
+  if (!classifyDisplayRequest(event.request, self.location.origin)) {
+    return;
+  }
   event.respondWith(
-    handled.then(
-      (response) =>
-        // `undefined` means this worker recognized nothing and must not change what the browser would
-        // have done. Re-issuing the request is the only way to say that from inside `respondWith`.
-        response ?? fetch(event.request),
-    ),
+    handleDisplayFetch(event.request, self.location.origin, environment).then((response) => {
+      if (!response) {
+        // Unreachable: the classification above is the same one `handleDisplayFetch` performs. A
+        // network error is the honest answer if that ever stops being true.
+        throw new TypeError("Ekklesia display request was not handled.");
+      }
+      return response;
+    }),
   );
 });