fix(juggler): restore scoped closed-shadow access

[Cloudymap1e]

Related Issue

Closes #628

Description

The Firefox 146 Juggler ESM migration stopped honoring forceScopeAccess, so trusted automation could no longer reach the chrome-only shadowRootUnl accessor used for closed shadow roots.

This restores the historical explicit opt-in behavior without changing the default context or elevating the evaluator to the system principal. When forceScopeAccess is enabled, Juggler uses the same page-scoped expanded-principal/Xray pattern as its isolated worlds and installs one compartment-local shadowRootUnl getter. A narrowly exported callback backs that getter and returns only the native chrome-only shadow-root attribute; its temporary global binding is deleted immediately. Page scripts cannot see the accessor, hostile page expandos cannot intercept it, and no chrome helper or system-principal evaluation realm is exposed. When the setting is absent, Juggler continues to execute against the existing content-page window.

Type of Change

• Bug fix
• New feature
• Documentation update
• Other

Testing

• Focused scope suite: 5 passed
• Broader Playwright evaluation suite: 59 passed, 8 existing Camoufox-unsupported cases skipped
• Enabled-mode coverage includes closed-root access, hostile page getter/expando isolation, privileged-global/constructor-escape checks, DOM and JavaScript handles, navigation, and child-frame context recreation
• Default-mode coverage verifies that an absent setting does not expose shadowRootUnl
• Security probe: cross-origin fetch, cross-origin XHR, and file:// fetch all remained blocked
• node --check additions/juggler/content/FrameTree.js: passed
• Independent final security review: passed; no concrete blocker found in the page-scoped accessor design

Fingerprint Report

build-tester/run_tests.sh ... --no-cert reported grade A with 1025/1048 checks across eight profiles, above the PR checklist's required score of 1000. The harness returned status 1 because it requires 1048/1048 for a zero exit; all 23 misses were local screen-size expectation differences on the bounded 1920x1080 validation host.

Validated artifact omni.ja SHA-256: b6ee2601d86c79481c4a734f7d995d6c211b4aeeadadd19246fa8ae8613d86e5.

Checklist

• I have linked a related issue above
• My changes are focused on a single logical change
• I have added testing instructions which include the desired result
• Service tests pass (for python library changes) -./service-tester/run_tests.sh --browser-version official/prerelease/146.0.1-alpha.25 (attach screenshot) temporarily out of service lol
• Build test passes (for patch changes) - score 1023, required threshold 1000