Sends tainted data to navigator.clipboard.writeText. Clipboard APIs require a secure context (HTTPS or localhost) and a user gesture.
Payload is also read from ?payload=..., #hash, or the textarea when primed.
If the call is rejected (permissions), the IAST hook still observes the attempt.