Ground-truth check of v2.1.1/v2.2.0: both ship a cookie-only getUpdateinfo (no
browser headers), v2.1.1 on a plain client, v2.2.0 adding ConnectionClose. So the
Direct data call must carry no User-Agent either - move the UA off the shared
client and behind the browserHeaders gate, so it rides login and the PageWalk but
not the Direct getUpdateinfo, which now matches the shipped request exactly.

Also give each flow its own fresh login: a Direct probe that 401s on the CLEI
variant leaves a forced-PON-password session state that could poison a following
PageWalk if they shared one login. Matches how the confirmed curl ran (one login,
then walk).