feat(sessions): add engine-isolated private contexts

[SarthakWade]

Summary

• add session create NAME --isolated using non-persistent WKWebView stores and disposable Chromium browser contexts
• keep normal and isolated cookies, storage, cache, permissions, and authentication state separate
• add session-owned, bounded in-memory credential brokers for interactive private enrollment and alias reuse
• expose only private aliases inside private AUTH_REQUIRED challenges and erase them on session close, profile clear, host stop, or crash
• preserve normal session sharing and durable profile behavior

Security

• isolated sessions never query or write the durable credential broker
• every private credential remains exact-origin bound, bounded to 100 records, unavailable to other private sessions, and explicitly cleared on teardown
• browser contexts cannot be imported, reused, named by callers, or persisted
• Chromium creates contexts only through the inherited DevTools pipe and disposes partial contexts on failure
• macOS uses a fresh WKWebsiteDataStore.nonPersistent() per isolated session

Verification

• pnpm test (59/59 protocol tests plus secure prompt and MCP integration)
• pnpm test:runtime
• pnpm test:npm
• pnpm build
• local pnpm test:e2e:mac
• GitHub workflow-dispatch macOS WKWebView E2E
• GitHub Linux Docker E2E
• pinned Prettier check and git diff --check
• pnpm audit --prod: no known vulnerabilities

The first local and first manually dispatched macOS E2E attempts stopped at the pre-existing durable-profile timing assertion. Each passed from a clean rerun; #178's independent full workflow also passed that gate. Local Docker remains unavailable because the Docker Desktop daemon socket is non-responsive, so the independent GitHub Linux Docker E2E is the Linux result.

Scope

This completes the isolation and private-credential portion of #35. Hover, drag, select, and response-body ideas remain explicitly undecided in that tracking issue.

Depends on #178.