fix(detection): stop scoring two signals that genuine browsers also produce

[cport1]

webdriver_configurable and chrome_runtime_missing were reported as Playwright artifacts and scored at 0.7 and 0.6 in the headless category. Neither indicates automation.

Evidence

Measured in Chrome 150, driven by a person, navigator.webdriver === false:

signalsTheClientWouldReport: ["webdriver_configurable", "chrome_runtime_missing"]

• webdriver_configurable — WebIDL defines navigator.webdriver as configurable, so every browser reports the descriptor exactly as a patched one does.
• chrome_runtime_missing — chrome.runtime is only exposed to a page when an extension declares externally_connectable matching it. On an ordinary site, an ordinary Chrome has none.

Both fired on genuine Chrome, together, giving those visitors a headless category score of 0.771 and roughly +0.116 on their final score.

Change

The client no longer reports either signal, and all three servers ignore them when received, since deployed clients will keep sending them for a while.

webdriver_deleted and playwright_globals are unchanged — deleting the property or injecting framework globals is deliberate tampering that no shipped browser does.

Impact

	before	after
a genuine Chrome's headless category	0.771	0
a genuine Chrome's score	~0.23	0.111
bench agent TPR	97.33%	97.33%
bench human FPR	0.00%	0.00%

Agent detection is unaffected: automated browsers are identified by navigator.webdriver being true, which is dispositive on its own, so every captured agent class stays at 100%.

Also: touch form submissions

The submit classifier consulted only keydown and mousedown within 100ms of the submit event. touchstart was recorded in the event log but never read, so a tap whose compatibility mousedown lagged read as a programmatic submit — as did any click-to-submit slower than 100ms on a loaded device.

Now selects by time rather than by the last five entries (scroll events share that log), considers touchstart, and allows 500ms.

Tests

Five end-to-end cases covering both directions of each change: a genuine Chrome's signal set raises no headless detection and is allowed, deleted-webdriver and injected globals are still detected, a tap-submitted form is not flagged, and a genuinely programmatic submit still is. All three servers pass.

Node 98/98, Go 94/98, Python 85/98 — each up by the five new cases, pre-existing divergences unchanged.

[cport1]

Holding this. The conjunction rule is unsafe and must not merge as written.

Tested in a real Chrome 150 (not Playwright-driven, navigator.webdriver === false):

signalsTheClientWouldReport: ["webdriver_configurable", "chrome_runtime_missing"]
countTowardConjunction:      2
wouldBeBlockedByNewRule:     true

A genuine browser produces both artifacts, so the rule would block every Chrome visitor at 0.9. My reasoning that each signal has a separate false-positive path, and that requiring two closes both off, was wrong — they fire together on ordinary Chrome.

Reworking: the underlying issue is that neither signal indicates automation in the first place.

[cport1]

Reworked. The conjunction rule is gone; the change is now to stop scoring the two signals entirely, since a genuine browser produces both.

Bench after the change: agent TPR 97.33% with every captured class at 100%, human FPR 0.00%. Removing them costs no detection, because automated browsers are identified by navigator.webdriver being true.