fix(core): complete phase one hardening

[yashranaway]

Closes #20

Summary

• bound Chromium teardown, use libc peer credentials, and make diagnostic/header handling deterministic
• atomically finalize artifacts without overwrite races and harden recording lifecycle/startup
• align flow/QA parsing timeouts and enforce the HTTP(S)-only macOS navigation boundary
• document the resulting contract and close the A9 backlog checklist

Validation

• npx --yes pnpm@9.15.0 test:runtime
• Swift 6.1 protocol suite in the Linux Docker build (40/40)
• npx --yes pnpm@9.15.0 test:e2e:linux
• sh -n apps/headless/Tests/linux-e2e.sh
• git diff --check