When one asks if something is free software (a.k.a. FOSS) the concern isn’t so much trust but rather can one view, modify, and share the program. Sandboxes solve a different problem.
In the case of a javascript bundle, in order for a user to exercise the Four Freedoms they must at minimum be provided with corresponding source code for each component in the bundle, and preferably some way in the browser for the user to inspect and modify it. In other words, it must be treated like any other compiled binary program. A lock file with specific versions probably isn’t necessary (and server configuration and source code definitely isn’t).
You are right in that this would require cooperation from the service provider to provide this metadata, and most definitely would not do this. Therefore, such an extension as OP suggests would have the effect of blocking the vast majority of javascript on the web today. LibreJS tries to some extent but I don’t know how well it can handle bundled javascript files.
Assuming they own the copyright (which I believe they do, since they were able to relicense it to begin with) they can absolutely offer it under a dual licensing arrangement even if the licenses are incompatible. It would only be an issue if other peoples’ AGPLv3 licensed code was in there, but as it is not the only copyright they would theoretically be violating is their own, which is literally not possible.
Dual licensing under a free software license and proprietary EULA is a common business model, especially when the free software license is a strong copyleft like the AGPL, since the proprietary licensors do not have to abide by certain conditions that free license users have to.