feat(browser): bridge client page renderer mounts

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	7	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​511	$\color{#cf222e}{\Huge{\mathbf{−}}}$​10	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​501
Prod	10	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​864	$\color{#cf222e}{\Huge{\mathbf{−}}}$​44	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​820

ELI5

This adds the locked door between Electron main and the current desktop renderer. Main can ask that exact renderer document to create or retire one blank browser guest in a main-approved partition. The message carries no target URL, so renderer code cannot choose where the guest connects or navigates.

This stage is production-inert: there is no renderer consumer, capability advertisement, placement activation, or server-hosted migration yet.

What Changed

• Added schema-validated mount and retire IPC for exact page generations.
• Bound replies to the exact current renderer object, main frame, request, operation, and page identity.
• Bounded pending work to 512 requests with fail-closed timeout, abort, replacement, process-loss, malformed-reply, and disposal handling.
• Fenced renderer-document replacement while preserving blocked, cancelled, and prevented navigation that leaves the original document alive.
• Added deterministic reliability coverage and real Electron lifecycle coverage.

Why

The existing command executor in #14566 could prepare a routed blank guest, but no trusted main-to-renderer mount bridge existed. This stage establishes that boundary before adding the renderer-owned page registry and preload consumer.

Linked Issue

Part of STA-4150.

Stack: #14440 through this PR, based directly on #14566.

Visual Proof

N/A — this stage has no renderer consumer or user-visible behavior.

Testing

• 8 focused reliability files: 174 tests passed.
• Browser/window suite: 88 files and 1,168 tests passed; 1 intentional skip.
• Paired-runtime rebase conflict oracle: 2 files and 21 tests passed.
• Real Electron 43.1.0 lifecycle spec: 3/3 passed.
• Isolated headless Orca host plus separate paired Electron web client: 1/1 passed.
• pnpm run typecheck, pnpm run lint, pnpm run check:code-quality:changed, and git diff --check passed.
• Validated locally on macOS. Linux/Windows packaging and cross-version checks are delegated to required CI.

Review

• This is local main↔renderer IPC, not paired-runtime wire. No exchanged remote field, opcode, or host publication changes.
• Old clients, old servers, explicit server/offscreen placement, browserless hosts, SSH, WSL, folder workspaces, and git worktrees remain on existing behavior because activation is absent.
• Mount carries the approved partition and exact page generation, never the target URL.
• Pending resources and navigation state are bounded and fail closed.

Checklist

• This PR is small and focused
• I explained what changed and why
• Visual proof is N/A because there is no visible behavior
• Self-reviewed for correctness, security, lifecycle, and performance
• Cross-platform, SSH/remote, and mixed-version impact considered
• Relevant local validation passes; required CI is running