Enforce source-backed browser navigation lifecycle

[jt55401]

Summary

• parse and retain source snapshot nodes for every signed section
• map nested and reordered live sections to their source identity
• invalidate verification after section, navigation, or document base URL changes
• refuse live-DOM verification when an accepted source snapshot is unavailable
• place extension indicators after the outermost signed section
• pin browser-client a846e3d971ab93bdcc8a9f599fb1987828344983

Verification

• clean npm ci --ignore-scripts=false
• npm run typecheck
• npm test -- --runInBand (63 tests)
• npm run lint (0 errors; existing warnings)
• npm run build:chromium

Refs #4

The v1 signing-object migration remains separate protocol work.