test(browse): CDP allowlist + two-tier mutex

13 tests:
- Allowlist linter: every entry has 4 required fields, no duplicates,
  justification length > 20 chars
- Deny-list verification: dangerous methods (Runtime.evaluate, Page.navigate,
  Network.getResponseBody, Browser.close, Target.attachToTarget, etc.) are
  NOT allowed (Codex T2 categories 4-7)
- Per-tab mutex serializes ops on same tab
- Per-tab mutex allows parallel ops across different tabs
- Global lock blocks tab locks; tab locks block global lock
- Acquire timeout yields CDPMutexAcquireTimeout (no silent hang)
- Timeout error names the tab id and the timeout budget

Also extends Network.disable justification to satisfy linter.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

browse/src/cdp-allowlist.ts

@@ -185,7 +185,7 @@ export const CDP_ALLOWLIST: ReadonlyArray<CdpAllowEntry> = Object.freeze([
     method: 'disable',
     scope: 'tab',
     output: 'trusted',
-    justification: 'Domain disable.',
+    justification: 'Domain disable; mirrors Network.enable for cleanup symmetry.',
   },
   // NOTE: Network.getResponseBody, Network.getCookies, Network.replayXHR,
   // Network.loadNetworkResource are INTENTIONALLY NOT allowed (Codex T2 cat 7).