OpenPencil design preview and editing plugin

Key features

• Image and document grants are signed, hash-bound capabilities.
• DSH_OPENPENCIL_SOURCE_ROOT (or OPENPENCIL_SOURCE_ROOT) for the web bundle and CanvasKit assets.
• imagePNG path, preview/download URLs, and real width/height
• Follow-up edits to an existing canvas require an already-open managed editor.
• Browser metadata never exposes an arbitrary host path, and signed preview/editor capabilities never enter the canonical tool result or model context.