Thank you very much, @jshaffstall, for the explanation, the Javascript call that works in most browsers, and the link to caniuse!
I case it’d help anyone in future to see a simple worked example, the following table contains links to an app with Embedding enabled, and examples of how it presents differently when embedded within sites that have been Allowed, Forbidden, or are Unknown.
| Role | App | Clone link |
|---|---|---|
| Luke | https://luke-skywalker.anvil.app/ | Anvil | Login |
| Ben Kenobi | https://ben-kenobi.anvil.app/ | Anvil | Login |
| Darth Vader | https://darth-vader.anvil.app/ | Anvil | Login |
| Random website | https://random-website.anvil.app/ | Anvil | Login |