The key would be a permission prompt like browsers now have for camera access, notifications, geolocation, pop ups, etc.
If a page uses too much CPU it will get throttled and ask the user if they want to unthrottle it.
Website owners currently assume they’re entitled to as much of my processor time and battery life as they want, just as they once assumed they were entitled to display popup ads just because they could. If this behavior is going to change, it will only happen because browsers stop letting them and instead say “No, this is the user’s CPU time, not yours.”