Integrate protected authenticated transactions into live IB renderer path

[isomorphisms]

Context

Issue #59 established the protected-authenticated-transaction requirement and the webview acceptance fixture proved the Android renderer/session mechanisms on a physical low-RAM phone. PR #70 integrates that fixture into the repository.

This issue carries the remaining product integration boundary. The acceptance fixture is evidence and test equipment; it must not become IB's browser model.

Required integration

• Represent protected authenticated transaction policy in browser-owned state, attached to the existing tab/history/task identities rather than to a WebView instance.
• Make ordinary renderer eviction prefer unprotected work before a protected transaction.
• Keep authentication/session material needed to continue the transaction outside renderer-only ownership.
• Provide the live renderer adapter only the narrow services/state it needs to resume the existing browser-owned transaction.
• On renderer loss, retain the tab/history/task identity, attach a replacement renderer, and reconstruct the strongest safe continuation available.
• Preserve neutral navigation/view state and any explicitly permitted ordinary form state.
• Do not persist password fields, synthetic secrets, or arbitrary sensitive field contents merely to claim restoration.
• Do not claim JavaScript-heap continuity. Renderer death must remain distinguishable from live-renderer survival.
• If a site cannot be safely reconstructed, surface that limitation rather than presenting a fresh or unauthenticated page as successful recovery.

Acceptance

Reuse the distinctions established by #59 and the merged WebView fixture, but exercise them through the actual IB live-renderer/browser-owned path:

1. authenticated cookie/session survival under app switching and bounded memory pressure;
2. ordinary in-progress form-state survival while the protected renderer remains live;
3. explicit evidence of whether the renderer survived;
4. authenticated reconstruction after forced renderer death;
5. sensitive fields excluded from browser-owned restoration;
6. recreated JavaScript heap reported as recreated, not continuous;
7. tab/history/task identity unchanged across renderer replacement.

Physical-device evidence must identify the exact source head, Android/API/WebView tuple, and keep emulator evidence separate from physical acceptance.

Boundary

Host-process-death/reboot recovery is not silently folded into this issue. If durable whole-app restart recovery is required, track and test it separately so renderer death and host-process death remain distinct.

[isomorphisms]

PR #70 has merged the #59 acceptance harness into main at 6b0eaebcb243cb674425b4c343252958103f54e2. This issue now owns the remaining live IB browser-core/renderer integration; the acceptance fixture remains test equipment rather than the browser state model.