v2.4.0

fix: audit v2.4.0 — fail-closed rules, split popup

External audit, all findings:
- fresh source ids on profile duplicate + dup-id migration
- central header/RE2 validation; applyRules fails closed,
  records status; popup banner + "!" badge; lastSig only
  kept on success and invalidated on failure
- URL edit clears catalog; failed refresh marks rows stale
- queued sync-first saves, one global error surface
- 10s fetch timeout, refresh button disabled while running
- share format v2 (source selections travel), /i page
  hardened + parity-tested by executing its real script
- landing page: telemetry claim scoped, GoatCounter disclosed
- a11y: escape/focus, arrow tabs, labels, live regions, 24px
- CI on tags; sign-firefox gates on tag<->manifest + tests
- popup.js split into popup/ ES modules

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>