I'd be OK with keeping both in the same client, with warnings when transitioning from one to the other (say, you follow a link on a web page to a web app), if that's what it took. It'd be like the HTTPS lock and content-origin policies and such but for guaranteeing the page you're visiting isn't actually a "page" that's spying on you and doing all kinds of other nasty stuff, or that the link you're following may go to a page that's a god-awful pain in the ass to read and burns your battery up ("modern" designed web articles). Like a not-shit version of Google's AMP, kinda.

It'd be better separate if that worked out—if all the things that work just fine without JS and advanced CSS went to the New Web I'd be able to arrange things so I rarely need anything else. Web apps blow and I try to avoid them when possible, or, increasingly, they're better off in Electron for reasons including that it's quicker to get to them to murder them mercilessly when they go rogue, than it is with some tab somewhere. But a unified client for both that kept them strictly separate would at least be a lot better than what we have now.

Everything you describe is a usability nightmare including "with warnings when transitioning from one to the other". You might not use any web applications but major web applications are the most used sites on the web.

Would it not be better to provide full functionality and simply use better sandboxing to avoid spying and nasty stuff? Reducing functionality is like throwing the baby out with the bathwater -- you really want better privacy and more control but rather than attack that problem you want to take the web back 20 years. That's a solution but it's not a very good one.

I personally don't think that browsers shouldn't leak all the information that they do -- that should be a hole to be plugged.