Fix: [for cherry-picking] Corrected cross-origin response metadata, doc

[qodo-code-review]

Fixed Findings

• Preserve CORS response types
• Document sandbox matrix review
• Restore sandbox regression coverage

Automated fix from agentic review of #2

---

Summary by cubic

Fixes cross-origin fetch response metadata so __zpFetchMeta.type now reports cors for cross-origin CORS requests instead of falling back to basic or opaque. Adds a comment in web/runtime-prelude.js documenting the sandbox-boundary change against the PHASE2 plan E1 escape matrix.

• Response type now reflects the actual CORS mode: cors for cross-origin CORS, opaque for cross-origin no-cors, basic otherwise.

^{Written for commit 8b763ac. Summary will update on new commits.}