Fix Figma host message handling

[DavidBabinec]

What changed

• accept wrapped Figma host messages without assuming event.source === parent
• keep raw bundled-editor messages isolated through the existing iframe-source check
• add regression coverage for null-source and non-parent-source host messages
• run the Figma messaging test in CI

Root cause

Figma desktop can deliver pluginMessage events with a null or non-parent event.source. The 2.0 UI discarded those messages, so both successful imports and import errors left the connection card spinning forever.

Validation

• bun run --filter './packages/figma' test
• bun run build:figma
• bun run release:figma -- 2.0.0
• open-source boundary checks for source and packaged Figma output