fix: isolate ProofShot session lifecycle

[justinTM]

Summary

• separate stable session control state from arbitrary artifact output
• resolve output relative to the project config so nested working directories share one session
• keep browser sockets short and browser discovery inside the isolated HOME
• record immutable process identity and stop only the exact owned browser/server trees
• refuse an unrelated occupied port and clean partial starts safely
• make stop idempotent, retain --no-close ownership, and preserve console evidence before fallible cleanup
• support an explicit --url for audit targets

Verification

• 18 test files and 51 tests pass from detached clean commit f71514b64b453cb6a9c6bca729b8b7a4ec096cef
• TypeScript build passes
• Integration coverage uses deliberately long paths, nested working directories, unrelated listeners, partial startup failures, retry cleanup, and retained-browser cleanup
• Independent lifecycle review is clean

Related work

This implements the isolated audit-session dependency tracked at https://git.services.nesdis.noaa.gov/archive/oiss-devops/-/work_items/267.

PR #43 is complementary presentation and navigation work. It is intentionally not treated as semantic session-lifecycle completion.

The seven npm audit findings are pre-existing dependency findings and are outside this narrowly scoped lifecycle change.

[justinTM]

Downstream self-hosted acceptance is complete on f71514b.

• Detached clean checkout: 51 tests across 18 files passed; package build passed.
• Real lifecycle: long generated evidence path, isolated HOME, nested working directory with ancestor config, custom output, automatic browser discovery, and intended target opened.
• Stop removed the exact owned server/browser identities; a separate unrelated process stayed reachable; a second stop was a clean no-op.
• The session bundled six screenshots plus video with zero console errors and zero server errors.

This validates the isolated session-lifecycle boundary only. PR #43 remains complementary presentation/navigation work, not a substitute for these semantics.

[justinTM]

Fresh acceptance run at PR head f71514bf0dbe6a7c754a740ce7d09ba7b181b95a:

• npm test: 18 files, 51/51 tests passed, including all three isolated lifecycle integration tests.
• npm run build: passed.
• A real docs-via-gas clean-checkout audit used this PR build with a custom evidence output, separate start / exec / stop CLI processes, seven screenshots, and a 229-second recording.
• stop bundled the session, removed only the owned preview listener on 8075, and left the pre-existing unrelated Python listener on 8067 (PID 1080816) running.
• Browser and server error counts were both zero.

The complete ProofShot bundle and representative images are attached to the consuming MR: https://git.services.nesdis.noaa.gov/justin.mai/docs-via-gas/-/merge_requests/3#note_402827

This is implementation and lifecycle acceptance evidence; it does not claim this upstream PR is merged.