Add secure browser preview routing

[chubes4]

Summary

• Add preview-mode=local|public|secure routing metadata for browser evidence runs, with local preview remaining the default.
• Record requested/effective preview mode, local/public/effective origins, secure-context status, and preview diagnostics in browser summaries and review artifacts.
• Fail secure preview requests clearly when a public HTTPS preview is not configured or when the reached page is not a secure browser context.

Closes #662

Testing

• npm run build
• npm run recipe-preview-routing-browser-probe-smoke
• npm run browser-probe-artifact-smoke
• npm run browser-actions-artifact-smoke

Known issue

• npm run artifact-contract-smoke currently fails on an existing stale metadata assertion expecting metadata.provenance.task.previewPublicUrl; current CLI metadata records preview details under metadata.provenance.task.preview.effective.publicUrl.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Implemented the preview routing/artifact metadata change and smoke coverage; Chris remains responsible for review and merge.