Killing javascript access to file:// would be annoying for quick experimenting.
Maybe denying network access to locally loaded JS, so that nothing could be transferred out is possible solution?
Well, it's not a big deal. Just run `python3 -m http.server` or install "http-server" via npm.
The "click on the html file on the desktop" just works(TM)