Verify immutable v1 navigation sources

[jt55401]

Summary

• retain exact signed-section source slices from the accepted response
• keep parser-owned DOM elements for identity and rendered comparison
• bind verification to the final response URL and its source base URL
• refetch pristine source in both content-script and background paths
• keep verification UI outside signed content
• pin browser client d25c6d3c and canonicalization b0c8f305

Validation

• clean npm ci --ignore-scripts=false
• npm run typecheck
• npm test -- --runInBand (64 passing)
• npm run lint (0 errors; 82 existing warnings)
• npm run build:chromium
• git diff --check