* fix: support Windows Opera and Opera GX cookie imports
Fixes#2957
* fix: repair Windows cookie decryption and make Opera import failures actionable
- strip the SHA-256(host_key) prefix Chromium adds to v10 values (DB meta v24+) on Windows
- keep receipts and name `$B handoff` recovery for App-Bound rows in browsers without native extraction
- explain missing browsers, missing profiles and ambiguous profile selection with next steps
- add windowsNative/resolveBrowserInfo, the operagx alias and sorted failure reasons in CLI output
- cover the Node server runtime with a real-DPAPI Windows test
* docs: document Windows Opera cookie import and guard browser lists against drift
* chore: file cookie-import follow-ups from the Opera fix wave review
* test: keep Opera receipt tests independent of the shared key cache
* test: declare generated gstack/llms.txt as a command-reference input for PR selection
* chore: release v1.91.4.0
* test: reconstruct the historical cookie-workflow approval after the Opera BROWSER.md additions
* test: run the real-DPAPI Windows check with the runner's environment
PowerShell launched with a stripped environment took ~18-21s on the Windows
runner (measured on a throwaway diagnostics run), past dpapiDecrypt's 10s
deadline; with the full environment it returns in ~0.3s. Only APPDATA is
redirected to the fixture's Opera root.
---------
Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
* fix(browse): prepare reliable cookie import wave for validation
* ci: sequence quality and behavior for validation branch
* fix(browse): isolate Windows qualification and preserve native diagnostics
* test(browse): cover cookie workflow quality and isolate Windows user paths
* test(browse): trace native member startup and initialize fresh folders
* fix(browse): keep Windows member stdin alive through EOF
* fix(browse): latch native timeouts and compare contained Edge startup
* test(browse): verify native version metadata and actual Windows argv
* test(browse): qualify Dia import on isolated macOS CI
* fix(browse): require picker origin for session mutations
* fix(browse): bound credential reads through stream completion
* test(browse): inspect owned Windows process arguments natively
* test(evals): preserve passing coverage during cookie repair reruns
* test(browse): isolate Dia qualification in a fresh macOS account
* test(browse): pass bounded integer timeouts to native Mac probes
* test(browse): distinguish Windows profile initialization from containment
* test(browse): await descendant pipe readiness before parent exit
* test(browse): initialize and restore isolated macOS Keychain state
* test(browse): initialize Windows fixture folders before qualification
* test(ci): pin the same Node runtime across Windows checks
* test(browse): distinguish native macOS browser preflight stages
* test(browse): isolate Windows descendant console lifetime
* test(browse): preserve native receipts and identify fixture lock holders
* test(browse): prepare dependency resolution before native Mac worker startup
* test(ci): include lock and close checks in native diagnostics
* test(browse): preserve native owner probe stages and subprocess deadlines
* fix(browse): classify Chromium profile-in-use exit precisely
* test(browse): retain Mac qualification evidence through cleanup failures
* test(browse): bound Mac fixture paths and retire its owned user domain
* test(browse): accept vanished fixture entries without weakening cleanup
* test(browse): identify probe-created macOS user domains safely
* test(browse): observe Mac user domains without targeting them first
* test(browse): use passive fresh-user ownership throughout Mac qualification
* test(browse): distinguish profile and registered-home Keychain lookups
* test(browse): qualify Dia under one registered account home
* test(browse): identify Dia startup and owned process-group failures
* test(browse): classify bounded Dia startup diagnostics without leaking output
* fix(test): preserve native Mac sandboxing and reap owned browser children
* fix(browse): preserve Chromium sandboxing for native profile imports
* test(browse): inspect signed Mach-O architecture without launching Xcode tools
* test(browse): sample pending Dia startup and reap on all cleanup paths
* test(browse): compare protected Dia launches in fresh Bun and Node accounts
* test(browse): inspect isolated Mac GUI readiness without browser access
* v1.90.0.0 fix: bind cookie picker actions to their document
* test: validate cookie guards and fit nested launch fixtures
* ci: configure the bundled Chromium sandbox helper
* fix(browse): classify Playwright authentication timeouts
* test: retain bounded Windows lifecycle diagnostics
* test(cso): reuse bounded NTFS precision candidates
* test(review): handle explicit preservation choices safely
* test(browse): remove owned fixture directories with explicit primitives
* test(review): distinguish descriptive reuse from edit commitments
* test: admit only the approved unscored cookie workflow refusal
* test: keep the Office Hours judge mock export-complete
* fix: keep dependency-free CI planners independent of the model SDK
* test: observe the exact holder after a native fixture unlink failure
* fix: start seeded PTY observations at owned readiness
* test: acquire identity-bound Windows deletion admission before profile resets
* test: preserve qualified Git index bits without authorizing mutations
