Thank you!
One cannot easily abuse PointerLock API since the visitor can press Escape at any time to unlock the cursor, cursor can only be locked on interaction, and keyboard shortcuts to close/switch the page cannot be overridden.
As for window_mouse_set/display_mouse_set - kind of. Always has been.