fix(stealth): harden anti-detection against advanced fingerprinting

[jackwener]

Summary

• navigator.webdriver returns false instead of undefined to match real Chrome behavior
• Stealth guard moved from discoverable window property to non-enumerable prototype property on EventTarget
• Interceptor globals (__opencli_intercepted, etc.) made non-enumerable via Object.defineProperty
• Monkey-patched fetch/XHR disguised with native toString() signatures, including Function.prototype.toString.call() bypass protection
• XHR instance URL property uses non-enumerable descriptor with neutral name
• Removed overly broad chrome-extension:// and self-exposing __opencli from stack trace filter patterns
• Updated download module User-Agent from Chrome/120 to Chrome/134
• Cleaned up dead STEALTH_GUARD export constant

Test plan

• All 242 unit tests pass
• TypeScript type check passes (tsc --noEmit)
• Manual verify: navigator.webdriver returns false on target sites
• Manual verify: Object.keys(window).filter(k => k.includes('opencli')) returns empty array
• Manual verify: fetch.toString() returns function fetch() { [native code] }

🤖 Generated with Claude Code