f4bdbd8da76120c087250fd09b45e34c147889eb  [Site Isolation] Attachments in cross-origin iframes can't be inserted or updated, and never get their icons

Classified as not security-relevant.
Triage note: Adds API::Attachment owningProcess()/setOwningProcess and routes UpdateAttachmentIcon/UpdateAttachmentAttributes to the process whose document holds the element (not always legacyMainFrameProcess), and iterates all local frames in attachmentElementWithIdentifier. Site-isolation correctness plumbing; no identified exploitable bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: smartptr_member_added (+6.47), null_guard (+2.59)