Harden confirmed sign-in transitions

[NotASithLord]

Closes #268
Closes #273

What changed

• require a confirmed, verified SSO action before a site actor can enter one exact identity provider
• park the full actor surface while the user completes sign-in, without model inference or page authority
• fail closed on stale, expired, replayed, unreadable, wrong-provider, and third-origin state
• carry terminal policy results through Chrome code execution and Firefox actor hosting
• show the relying site and exact provider in the confirmation UI
• update threat-model, ARC, and red-team coverage without pinning volatile counts in prose

Verification

• release preflight
• 5,633 Bun tests
• 856 in-browser tests
• red-team suite and generated report
• targeted side-panel E2E for IdP transit, login confirmation, and isolated actor code
• Linux authority visuals inspected in light and dark modes
• Firefox package lint and Gecko CI lane
• adversarial security, browser parity, human UX, and model UX review

[github-actions]

Visual regression

✅ No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 52 baseline screens (light + dark) as of this commit.