feat(browser): fence client page placements

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	1	+157	0	+157
Prod	3	+179	−36	+143

Summary

• extract runtime-owned logical page placement into a bounded registry
• require the exact runtime, authority epoch, browser-host generation, page-host generation, current client placement, and still-live host lease before client-page use
• reject retired, replaced, server, invalid, and over-capacity placement claims without reusing page generations

This is the next inert STA-4150 lifecycle boundary. It adds no exchanged field, RPC/event, capability advertisement, Electron IPC, renderer surface, or production caller. Server placement remains the default and existing old-client/server behavior is unchanged.

Why

The preceding route/WebContents stages can fence an active or retiring tuple, but the future IPC/control adapter still needs runtime-owned lifetime authority after retirement settles. Before this change there was no atomic API that joined logical placement identity to the current live browser-host lease, page placements were unbounded, and page/host IDs were not validated at this boundary.

T3Code independently validates the broad split—server-owned logical tab state with a desktop-renderer-owned Electron webview—but its renderer mounts the target URL and later registers {tabId, webContentsId}. Orca intentionally keeps the stricter blank → main-derived exact registration → navigation-grant sequence because remote localhost, DNS, and private traffic must never escape through the desktop network.

Evidence

• causal baseline: 5/5 new placement assertions failed on parent 5683c491dd because exact live authority, bounds, and identity validation did not exist
• candidate: 17/17 focused placement/lease tests passed, including the real default 256 → 257 capacity boundary and recovery at generation 257
• full main-runtime suite: 4,163 passed, 5 existing skips
• full main-browser suite: 773 passed
• full typecheck, type-aware/changed-code audits, reliability manifest, formatting, diff, and max-lines ratchet passed
• fresh correctness, security/performance, and lifecycle reviews found no publication blocker

Compatibility and activation gates

• no remote-wire or published-content change; docs/reference/remote-wire-compatibility.md remains satisfied without negotiation
• no mobile-facing surface, persistence schema, dependency, package, filesystem/path, native, or platform-specific behavior changed
• placement state is scoped to one runtime authority; bare page IDs never cross registries
• released-lease placements intentionally remain visible but unusable until lifecycle reconciliation retires/replaces them, preventing silent server fallback

Activation remains blocked on capability-qualified host selection, authenticated capability-gated command delivery, main-owned renderer/page grants, displaced-page teardown and acknowledgement, request/worker/download/storage settlement, reconnect inventory, and real Electron/CDP plus headed/headless/browserless and physical cross-platform traffic proof.

Linear: STA-4150