test: bind Cockroach Browser to exact Maqam authority

[AjnasNB]

Summary

• add a synchronous createDriver(authority) path for independently verifying browser drivers
• keep the verifier bridge active only during the exact registered ToolGateway call
• derive post-mutation observation as read-only authority with no mutation approval
• add an exact cockroach-browser@0.1.0 repository-only fixture for observe, preview, one-use approval, apply, re-observe, tamper, replay, stale-target, and inactive-authority paths
• run the exact fixture across Node 22, 24, and 26 in CI

Authority and license boundary

• ToolGateway remains the only registration and dispatch authority
• the bridge cannot register tools, mint plans, widen origins, approve, consume approvals, or dispatch work
• cockroach-browser is not a Maqam runtime dependency and is excluded from the MIT npm tarball
• the separately installed fixture dependency remains visibly AGPL-3.0-or-later

Verification

• 346/346 root Node tests passed
• 11/11 governed-browser adapter tests passed
• 2/2 exact published-package fixture tests passed
• clean external TypeScript consumer compile passed
• website contract passed: 19 HTML pages, 31 text assets
• root production audit: 0 vulnerabilities
• fixture audit: 0 vulnerabilities
• npm tarball dry run passed; no integration fixture or AGPL package included