After applying the fix in github.com/webadb/webadb., webadb.js is usable for fastboot.
It's a very incomplete implementation compared to the adb support but at least it appears to deal with the protocol framing.
Not going to be as much painful low-level work as I expected for it.
Conversation
It will need to identify the device model, download the correct factory image zip, extract images and metadata from the zip and feed the right commands / data into the fastboot protocol. Needs an implementation of guiding the user through the locking / unlocking workflow too.