Freeze the remaining exported constants that double as default arguments

[Hugoer]

Closes #18.

Freezes the five exported constants that double as default arguments, applying the same pattern — and the same lesson — as the CrUX pair in #17.

What was exposed

Each of these is exported from a public subpath and used as a default parameter value, so a consumer mutating one changed behaviour for every later call in the process:

Constant	Subpath	Was the default for
DEFAULT_PSI_STRATEGIES	psi	runPsi, runPsiBatch, runPsiAuditBatch
PSI_STRATEGIES	psi	strategy validation
DEFAULT_SKIP_AUDITS	lab, root	buildLighthouseConfig
CHROME_FLAGS	lab, root	every Chrome launch in lab.js and links.js
LAB_CATEGORIES	profiles	--category validation

DEFAULT_PSI_CATEGORIES is internal rather than exported, but is a default argument in the same way, so it is frozen alongside them.

CHROME_FLAGS is the sharpest of the five. The others cost quota — an extra request per URL against 25,000/day. Appending a flag to CHROME_FLAGS changes how every subsequent audit launches the browser, which silently invalidates scores.

Freezing alone would have repeated #17's mistake

DEFAULT_CRUX_FORM_FACTORS was frozen in #17 but declared string[], and string is not assignable to CruxFormFactor — so the constant could never be passed back into the option it was the default for. It was frozen and unusable at the same time, and the freeze only changed the error code from TS2322 to TS4104.

So each constant here gets both halves: an element type (readonly PsiStrategy[], not readonly string[]), and the options that receive it widened to accept a readonly array.

The chrome-launcher question the issue flagged

Answered: chrome-launcher types chromeFlags as a mutable Array<string>, so a frozen CHROME_FLAGS cannot be passed to it directly. The three call sites in lab.js and links.js now spread, the constant's comment says consumers must do the same, and type-tests asserts that spread keeps compiling.

That is a real ergonomic cost on the most likely use of the export, and it is the one judgement call in this PR. I took it because the alternative is an array that every audit launch reads and any consumer can quietly edit.

Verification

Every assertion mutation-tested — six reverts, six failures:

un-freeze PSI_STRATEGIES            -> caught
un-freeze DEFAULT_PSI_STRATEGIES    -> caught
narrow PsiBatchOptions.strategies   -> caught
un-freeze DEFAULT_SKIP_AUDITS       -> caught
un-freeze LAB_CATEGORIES            -> caught
un-freeze CHROME_FLAGS              -> caught

• npm run lint — 0 problems.
• npm test — 565 passing, unchanged.
• npm run generate-types — committed, no drift.
• npm run check-types — passes.
• Real browser launches, since the chromeFlags spread is a runtime change: the links command wrote output, and lab-audit, lab-save-runs, psi-audit and psi-save examples all pass.
• README needed no change — none of these constants appear in it.

Deliberately out of scope

PROFILES, NETWORK_PRESETS and DEVICE_PRESETS in lib/profiles.js are exported objects read by resolveProfileSettings, so PROFILES.low.network = 'wifi' would change every later audit — the same hazard class. They need a deep freeze, since Object.freeze would leave the nested preset objects writable, and that has different type implications. Filed separately rather than smuggled in here.