1. Caching, content-distribution-networks, and possibly shared-libraries could solve or at least ameliorate this.
2. This is relatively easy. The sandboxed code could "open" handles by calling into an API, and the code could "close" them when no longer needed.
3. In many cases, the GC is tied intimately to the semantics of the language, so enforcing a style of GC could be too limiting in terms of performance. Instead, it could be better to implement a GC'ed VM on top of the low-level one.
The biggest problem is to get something like this turned into a standard, and accepted in all browsers. Perhaps a viable route is to write the standard of this low-level virtual machine for the web (LLVM/W) on top of ASM.js (and implement threading by emulation), and then wait for general acceptance, and for browser vendors to implement LLVM/W directly.