Add policy-bound credential submission and native DLP audit proofs

tests/request-gate-timeout.test.mjs

@@ -9,12 +9,13 @@ const hook=source.slice(source.indexOf("  browserSession.webRequest.onBeforeRequ
 function fixture(){
  let listener,completeDNS;const timers=[],events=[],callbacks=[],policy=defaultPolicy();
  const context=vm.createContext({require:specifier=>require('../apps/browser/'+specifier.slice(2)),URL,Date,ready:true,policy,
-  browserSession:{webRequest:{onBeforeRequest(_filter,fn){listener=fn;}}},tabs:{all:()=>[]},currentTabContext:()=>true,
+  browserSession:{webRequest:{onBeforeRequest(_filter,fn){listener=fn;}}},tabs:{all:()=>[]},credentialBroker:undefined,credentialRequestCorrelations:new Map(),currentTabContext:()=>true,
   developerAssetRequestAllowed:()=>false,diagnosticSpan:(_name,_attrs,fn)=>fn(),core:{destinationAllowed:()=>true,inspect:()=>({decision:'allow'})},
   audit:async(...args)=>events.push(args),recentRequests:new Map(),dnsGate:()=>new Promise(resolve=>completeDNS=resolve),
   setTimeout:fn=>{timers.push(fn);return timers.length;},clearTimeout(){},Buffer,
  });
  vm.runInContext(source.slice(source.indexOf('function agentRequestOwnerAllowed(source)'),source.indexOf('function actorDestinationAllowed')),context);
+ vm.runInContext(source.slice(source.indexOf('function requestDiagnostic('),source.indexOf('function credentialContext(')),context);
  vm.runInContext(hook,context);listener({id:1,url:'https://example.test/',webContentsId:0,resourceType:'mainFrame',method:'GET'},r=>callbacks.push(r));
  return {timers,events,callbacks,complete:()=>completeDNS()};
 }