Web Workers: importScripts() not implemented -> Yahoo Finance app dies and redirects to /lookup

Environment

• obscura v0.2.1 (windows x86_64 stealth build) — also reproduced on a fresh cargo build --release of master @ 14ce517 (2026-09-04, default features)
• Windows 10 x64, obscura serve --stealth -p 9222, client = Playwright (Python) chromium.connect_over_cdp

What works

Plain pages render fine (example.com, and http://www.aastocks.com/tc/stocks/analysis/stock-aafn/0005/0/hk-stock-news/1 loads with a correct title), and the Yahoo SSR HTML itself is served correctly — obscura fetch --stealth reports the right title HSBC Holdings plc (0005.HK) Latest Stock News & Headlines - Yahoo Finance.

What breaks

Any page whose app needs a Web Worker that loads scripts via importScripts() fails its client-side boot. Concrete case — https://finance.yahoo.com/quote/0005.HK/news :

1. Yahoo's app resolves the quote symbol in a Web Worker that loads its protobuf dependency with importScripts(...)
2. Console shows:
   • Worker error: protobuf is not defined (repeated)
   • Worker error: undefined is not iterable (cannot read property Symbol(Symbol.iterator))
3. The app then hard-redirects to https://finance.yahoo.com/lookup/?s=0005.HK ("Symbol Lookup from Yahoo Finance") and never recovers — I sampled page.title() every 5s for 40s, stuck on the lookup page permanently.

Root-cause suspicion

Grepping the current master tree, importScripts has no implementation anywhere (grep -rn "importScripts" crates → 0 hits), so any worker that pulls libraries via importScripts() gets a ReferenceError for the imported globals. The Worker constructor itself is registered (runtime tests reference it), which is why this half-works: the worker starts, then dies on first importScripts call.

Repro

obscura serve --stealth -p 9222
# then, from Playwright (or any CDP client):
browser = chromium.connect_over_cdp("http://127.0.0.1:9222")
page = browser.new_page()
page.goto("https://finance.yahoo.com/quote/0005.HK/news")
# title ends up "Symbol Lookup from Yahoo Finance" instead of the quote page

Notes: the same failure happens with the page-provided UA and with the native UA, so it is not a UA/fingerprint mismatch — Yahoo serves the correct SSR HTML either way. Disabling --stealth makes the page fail even earlier (navigation never settles, "load-delaying dynamic scripts still pending" until the 30s deadline).

Even a minimal importScripts that fetches + evals the script URLs in the worker's global scope would unblock this class of sites. Happy to test a fix branch.