Top-level publisher (T): attribution-reporting denied via response header




CASE A — CONTROL: fenced frame created DIRECTLY by T


Expected: navigation blocked ("Refused to frame ... attribution-reporting").
   T's own allowlists_ contains an empty Allowlist for the feature, so the
   embedder check correctly fires.





CASE B — BUG: fenced frame created by NESTED cross-origin iframe E


Expected: navigation should ALSO be blocked — T opted out site-wide.

   Actual (bug): navigation commits. E inherited the denial (inherited_policies
   = false) but has no allowlists_ entry, so GetAllowlistForFeatureIfExists()
   returns nullopt and the gate is bypassed.