fix: align browser setup expiry validation with enrollment approval contract #354

The browser setup client and CodeAPI use different upper bounds for session expiry. parseStatus in packages/code/src/browser-setup.ts rejects expiresAt beyond attempt.request.createdAt + 10 minutes. issueBrowserEnrollment accepts expiry up to server Date.now() + BROWSER_ENROLLMENT_MAX_TTL_MS. Because attempt creation precedes capabilities, setup requests and approval, a valid maximum-lifetime approval can be rejected by the client.

The status parser also accepts any Date.parse-compatible expiry string, whereas the redemption/resume contract requires a canonical ISO timestamp through isBrowserEnrollmentTimestamp. A pending status can pass parsing but fail a later phase or resume.

Align client and server lifetime semantics without removing the upper bound or accepting expired approvals, and apply canonical timestamp validation at the status boundary. Add tests with delayed approval at the supported maximum lifetime and noncanonical-but-parseable expiry values, including resume. Preserve key, request-hash, instance and worker binding checks.

Validated from both implementations during the #342 import after a Bugbot finding.