window.stremio_server_url injection races with WebUI bootstrap

[kKaskak]

At wevbiew.rs:163-168, execute_script runs during content_loading but is async. The WebUI's inline <script> tags can execute before the injection lands, leaving window.stremio_server_url undefined when first needed. Same issue for stremio_server_ipc_key. Need a synchronization mechanism or use add_script_to_execute_on_document_created.

[kKaskak]

Verdict: valid with edge cases.

Reviewed against current main: I do not see window.stremio_server_url being injected here, so that half of the report does not match this tree. The race is still real for window.stremio_server_ipc_key and the shell bridge script: both are injected from add_content_loading via async execute_script, after navigation has started. Any WebUI inline bootstrap that reads them before the callback completes can observe undefined. Prefer document-created script registration where the WebView2 API supports it, or block bootstrap on an explicit ready handshake.