I think you have to first decide what kind of attacks you want to protect against. Will the attacker only be able to replace content of third party sites included in the main site (i.e. jquery.org) or will (s)he be able to modify the main site too?
onclick="dothis();") where not only the script code itself is relevant but also where this code is used in the HTML. Thus an observatory would not help for all but a few mainly static sites.
NoScript XSS filter is flawed.
All XSS filters are limited as are all antivirus solutions. It is impossible to reliably distinguish between good and bad with the limited information these filters have about what good and bad for a specific site might be. Either they block too much (false positives) or they miss something (false negatives). In the first case the user will switch off the filter and in the latter case it will not offer full protection.
Stricter sandboxing (for Windows), could prevent exploit code to access APIs that give access to username, computer name, MAC address, hostname, open connections to arbitrary IP addresses, etc.
Yes, I would not consider the current security architecture of Firefox optimal and I think Chrome provides a better protection against exploits which try to break out of the browser. On the other hand as far as I know Chrome does not provide the API you need for the full checks done by NoScript (i.e. XSS prevention, clickjacking detection...).
Another approach would be to run the OS with the browser itself inside some virtual machine so that the attacker would not only to break out of the browser but also out of the VM too to gain the relevant information. Each level of separation makes it harder for the attacker.
Could someone explain parts of the FBI's Firefox 0-day?