feat(js): adopt deno_url/web/crypto, enforce navigation deadline

[marcbachmann]

This branch replaces several broken / fingerprintable hand-rolled web API polyfills with their Deno counterparts, and adds hard deadline enforcement so a single page-supplied script can no longer hold the tokio executor past --timeout.

Three independent commits, each landable on its own.

Why

Obscura is intentionally lean — 30 MB memory, 70 MB binary, scoped to scraping and agent automation. That's a feature.

But several crates/obscura-js/js/bootstrap.js globals aren't lean — they're broken or fingerprintable:

API	Problem
URL	Regex-based; new URL('/foo', window.location) threw TypeError: base.match is not a function for any non-string base. Only handled http(s).
Blob/File/FormData	Blob joined parts as strings — new Blob([uint8Array]).text() returned "[object Object]". fetch file uploads silently corrupted.
TextEncoder/TextDecoder	JS-only, no ICU. Wrong on non-UTF-8 encodings, surrogate halves, fatal mode, BOM.
AbortController/AbortSignal	Stubs. abort() set a flag but never fired the 'abort' event. AbortSignal.timeout() didn't time out.
structuredClone	JSON.parse(JSON.stringify(v)). Silently corrupted Date, Map, Set, RegExp, Uint8Array, circular refs.
ReadableStream/WritableStream	Stubs. Streaming fetch().body, pipeTo all failed.
Event/EventTarget	globalThis.EventTarget = Node collapsed two unrelated prototype chains.
atob/btoa	Depended on the broken TextEncoder; wrong on multi-byte.
performance	Date.now()-based, no sub-millisecond resolution.
crypto.getRandomValues	Backed by Math.random() — detectable bias, no real entropy.
crypto.randomUUID	Template-string stub, not CSPRNG-backed.

Each broken implementation is also a fingerprinting tell. Any bot-detection service that probes new Blob([new Uint8Array([1,2,3])]).text() or checks structuredClone(new Date()) instanceof Date flags us as non-Chrome. deno_web / deno_url / deno_crypto are V8/ICU-native and match Chrome's behavior byte-for-byte — same direction as the existing stealth features.

What changes

1. feat(js): adopt deno_url for WHATWG-compliant URL implementation

Drops the regex-based URL polyfill. The deno_url implementation handles every scheme correctly, accepts non-string base arguments per spec, and is what real Chrome uses.

2. feat(js): adopt deno_web + deno_crypto, drop remaining broken polyfills

All-or-nothing — Blob ↔ FormData ↔ Response and EventTarget ↔ AbortSignal import each other internally, so they cannot be cherry-picked. deno_crypto is folded into this commit because it's standalone (~150 KB) and shares the same V8/extension wiring path.

Includes regression tests (mod tests in runtime.rs) pinning the behavioral contract that the polyfills broke — Blob.text() round-trips bytes, TextEncoder handles surrogate pairs, structuredClone preserves Date/Uint8Array, AbortSignal actually fires 'abort', crypto.getRandomValues produces real entropy.

3. fix(browser,js): enforce navigation deadline through synchronous V8 execution

tokio::time::timeout only fires at .await points. Any synchronous V8 work — script evaluation, module top-level code — holds the tokio executor thread for its entire duration, so pages with heavy synchronous scripts could run arbitrarily past --timeout with no way to stop them.

Adds navigation_deadline: Option<Instant> to Page and threads it through every execution phase:

• Script execution — each call receives the remaining budget as a hard ceiling. A watchdog thread fires terminate_execution() in a 10 ms loop once the budget is exhausted so that scripts with try-catch error-recovery handlers (which absorb a single termination) are still forced to stop.
• Network fetches — each parallel script fetch is wrapped in tokio::time::timeout(remaining_budget, ...). A slow CDN response can no longer exhaust the deadline by itself.
• ES modules — terminate_execution is catchable by JavaScript try-catch. A threshold guard skips any module whose remaining budget is too small to reliably stop, rather than starting work that cannot be terminated.
• Load-events / event-loop drain — capped at the remaining budget, checking the deadline on every iteration.
• Error surface — new PageError::NavigationTimedOut variant. The CLI's outer tokio::time::timeout could only fire once V8 yielded; the deadline is now enforced at the point of each V8 call.

Also switches eval_module_with_timeout from run_event_loop to with_event_loop_promise: the former waits for all pending work in the runtime to drain (blocking indefinitely on a page with a live setInterval), while the latter resolves as soon as the module's top-level evaluation completes.

Out of scope (intentional)

• fetch and XMLHttpRequest stay hand-rolled. They route through op_fetch_url, which enforces SSRF policy, blocked-URL patterns, the cookie jar, and the CDP Fetch domain's request interception. Replacing with deno_fetch would bypass the security model.
• setTimeout / setInterval now come from deno_web. The hand-rolled timers in bootstrap.js are removed.
• The existing URL.createObjectURL override is unchanged in shape — it still routes through the embedder-side BlobUrlStore.

Cost

• Snapshot grows by roughly +500–900 KB. Binary still well under the 70 MB target.
• ~30 LoC of Rust glue in crates/obscura-js/src/deno_extensions.rs (BlobUrlStore + TimersPermission).
• Version pin matches the current deno_core 0.350.

Verification

• cargo test --features stealth --workspace: 253 passed, 0 failed.
• cargo build --release --features stealth: clean (only the pre-existing RpcResponse visibility warning in obscura-mcp, unrelated).
• Regression tests for each replaced polyfill in crates/obscura-js/src/runtime.rs::tests lock the contract in place.