[codex] Harden privacy and stealth surfaces

[G-man3207]

Summary

Hardens Static's anti-fingerprinting behavior across several detector-visible surfaces:

• Removes own-property fingerprints from fake fetch and XHR decoy responses by storing fake state behind prototype accessors.
• Keeps passive non-persona element probes native-like: page-visible URLs remain coherent while resources fail locally with error events.
• Lets sendBeacon(chrome-extension://...) use Chrome's native HTTP(S)-only validation after logging the probe.
• Requires stronger repeated evidence before Noise claims unknown extension-shaped IDs, while keeping known plausible IDs eligible after the existing lower threshold.
• Adds per-origin persona rotation phase jitter so rotations do not align globally.
• Makes shareable research exports hash origin and extension-ID labels with a per-export salt that is not retained.

Validation

• npm run check
  • strict ESLint
  • static validation
  • 30 Playwright-backed extension tests under Xvfb

Notes

The raw export remains full fidelity for private archival. The shareable export is intentionally less useful for cross-user joining because privacy is the stricter default.