Merge origin/main (v1.91.7.0) into test-audit-reduction

Keep both intents: v1.91.7.0's functional QA, docsync and exploratory
paid cases and their free owners stay; this branch's deletions stay
deleted. main's new paid keys follow the derived-closure touchfile rule
(free *.test.ts paths dropped, static helper/fixture closure added), its
new helper-only tests join the ratchet baseline, and its free selection
examples that named free test files now assert the derived selection.

Periodic CI keeps seven slices without the retired Autoplan slice; the
gate census keeps seven single-worker slices with --skip-judges. Wall
and census literals are recomputed from the merged planner, durations
are re-recorded on Ubicloud, and VERSION stays 1.91.8.0 above 1.91.7.0.

browse/test/extension-token.test.ts

@@ -16,8 +16,11 @@
  * the network stack) lives in pair-agent-e2e.test.ts.
  */
 
-import { describe, test, expect, beforeEach } from 'bun:test';
+import { describe, test, expect, beforeEach, afterAll } from 'bun:test';
 import * as crypto from 'crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 import {
   buildFetchHandler,
   GSTACK_EXTENSION_ID,
@@ -28,6 +31,12 @@ import { BrowserManager } from '../src/browser-manager';
 import { resolveConfig } from '../src/config';
 
 const PINNED_ORIGIN = `chrome-extension://${GSTACK_EXTENSION_ID}`;
+const fixtureDir = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-extension-token-')));
+const fixtureConfig = resolveConfig({ BROWSE_STATE_FILE: path.join(fixtureDir, 'state/browse.json') });
+
+afterAll(() => {
+  fs.rmSync(fixtureDir, { recursive: true, force: true });
+});
 
 function makeConfig(overrides: Partial<ServerConfig> = {}): ServerConfig {
   const token = 'ext-token-test-' + crypto.randomBytes(16).toString('hex');
@@ -35,8 +44,9 @@ function makeConfig(overrides: Partial<ServerConfig> = {}): ServerConfig {
     authToken: token,
     browsePort: 34567,
     idleTimeoutMs: 1_800_000,
-    config: resolveConfig(),
+    config: fixtureConfig,
     browserManager: new BrowserManager(),
+    ownsTerminalAgent: false,
     startTime: Date.now(),
     ...overrides,
   };

browse/test/fixtures/qa-only.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>QA report-only fixture</title>
+  <link rel="icon" href="data:,">
+</head>
+<body>
+  <h1>Widget status</h1>
+  <p>The homepage is available.</p>
+  <script>console.error("TypeError: Cannot read properties of undefined (reading 'map')");</script>
+</body>
+</html>