For anyone who's curious, I attempted the following work-around:
- Detect if the game is running on iPad
- If so, prompt the user to click a link to load the frame's URL in a new tab (ensuring localStorage writes are no longer cross-domain)
#2 works, but, to my surprise, I couldn't find a reliable way to determine if the user is on an iPad. Recent Safari updates make iPads (and iPhones) claim to be desktop Macs, so you have to resort to fragile fingerprinting techniques. (Unsurprisingly, there also is no way to detect if "Prevent Cross-Site Tracking" is enabled.)
If anyone has other ideas, let me know!