Add WebView protected-transaction acceptance harness

[isomorphisms]

Summary

Integrate the executable Android acceptance fixture developed for #59.

The fixture stays separate from prepaint and exercises four claims independently:

• authenticated cookie/session survival;
• ordinary form-state survival while the renderer remains live;
• protected renderer survival / explicit renderer-death observation;
• reconstruction after renderer death without restoring the synthetic secret or pretending JavaScript heap continuity.

Physical evidence already obtained

At the original fixture head a6b00062fdc5bc551946059e0ea5533327edaf27 on the physical low-RAM API-34 phone:

• switch.session=survived form=survived secret-live=present renderer=survived renderer-gone-events=0
• renderer-gone didCrash=false,priority=2
• death.session=survived ordinary-form=reconstructed sensitive-form=not-restored heap=recreated reconstruction=observed

The renderer/session implementation files are unchanged by the reconciliation onto current main. Current-head changes after reconciliation only apply the repository-wide Android update-identity rule to this new installable harness.

Current-head gates

• WebView fixture unit test + lint + boundary checks
• pinned stable public test signer and certificate verification
• repeated replacement installation without uninstall
• APK artifact upload

Boundary

This merges the acceptance harness, not the final IB live-renderer/product integration. Host-process-death recovery and durable restart recovery remain unclaimed. A follow-up issue will carry the actual live IB integration boundary after this fixture is merged.