Spot-checking the other solvers headless after the init-script fallback
landed: Cloudflare (200, 11.8s), Kasada (200/687KB, 12.7s) and Alibaba Baxia
(18/18) all pass, DataDome does not -- ChallengeDetected, with
_verify_headless_patches reporting outerWidth=1440 innerWidth=1440
colorDepth=24.

That is the documented after-document-start limitation actually biting rather
than a separate defect: DataDome's tag.js fingerprints at document start and
reads the pre-patch values before framenavigated fires, while WAFs that
fingerprint later see the patched window. Recorded as a per-WAF matrix so
"headless works now" is not read as unconditional, with the wellfound row
carrying the same caveat.

Headed was re-verified after the shared-path change and is unaffected:
Cloudflare 12.8s, DataDome 6.0s, Kasada 7.5s, Akamai 9.2s, all 200.