#7253 fix(browser): harden desktop tool lifecycle

Summary

• harden desktop browser authorization, exact cancellation, wait-budget consistency, and current-versus-retired tool boundaries
• preserve known native outcomes across renderer unloads with compact beacon and keepalive delivery while marking genuinely indeterminate actions as unsafe to retry
• add privacy-safe queue/execution observability and remove an extra screenshot viewport round trip
• expand focused coverage for lifecycle races, authorization stalls, protocol drift, cross-frame effects, invalid input, and unload delivery

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other: ___________

Testing

• bun run lint and bun run lint:check
• bun run check:audits (39 audits)
• Sim focused Vitest suite: 8 files, 200 tests
• Desktop focused Vitest suite: 3 files, 193 tests
• TypeScript: @sim/app, @sim/desktop, @sim/browser-protocol, @sim/desktop-bridge
• Desktop bridge compatibility audit
• git diff --check

Review focus: native execution versus confirmation-delivery lifecycle, exact cancellation scoping, timeout hierarchy, and current/retired browser tool classification.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

N/A — no UI changes.