feat: persist authentication profiles across restarts

[SarthakWade]

Summary

• move Linux Chromium state from the runtime directory to a private XDG data profile
• add owner-checked 0700 setup, exclusive profile locking, safe legacy migration, stale migration cleanup, and corruption quarantine
• shut Chromium down gracefully so cookies and local storage flush before restart
• make WebKit's persistent data store explicit and add an isolated macOS E2E store
• add headless profile clear to close sessions and erase the normal profile on both engines
• publish durable-profile behavior in capabilities and update the source documentation

Security

• no caller-selected profile path or cookie-import surface
• lock file uses O_NOFOLLOW, O_CLOEXEC, owner/type validation, 0600, and a nonblocking exclusive lease
• unsafe legacy trees, symlinks, foreign-owned entries, and concurrent owners fail closed
• macOS E2E isolation fails instead of falling back to the developer's default store

Verification

• pnpm test
• pnpm test:runtime
• pnpm test:npm
• pnpm --filter @headless/web lint
• pnpm build
• pnpm test:e2e:linux
• git diff --check
• shell and fixture syntax checks
• macOS E2E persistence, logout, and clear paths passed locally; the existing foreground-focus assertion was separately flaky under the active desktop session, so this PR requests the fresh-runner macos-e2e gate

Stacked on #171. Closes #155.