test: delete the unreachable seal() hook and guard non-object RPC bodies

Three review findings, no redesign.

seal() was installed after session.close(), so onLate could never fire:
once the context is destroyed no route handler and no console listener
exists to record anything. It was dead code that the attribution table,
run.js and harness.js all described as the final safety net. Deleted
rather than moved — take() already drains everything the collector holds
before teardown, so it covered nothing, and this harness must not ship a
mechanism it cannot demonstrate. The now-unreachable `late > 0` term in
the failure condition goes with it.

handleRpc() parsed `postData || "null"` and then dereferenced the result,
so a POST whose body Playwright reports as null — a bodyless request, or
any payload it cannot decode as UTF-8, e.g. sendBeacon with a Blob —
threw a TypeError inside the route handler and killed node mid-suite:
truncated TAP, no summary, no failure line. Non-object payloads now take
the same path as unparseable ones and are reported as unstubbed traffic,
which is the entire point of that branch.

README claimed unrecognised outbound requests are reported as failures,
unqualified, while observation in fact ends TRAILING_WATCH_MS after the
last test returns. The limit is now stated where it lands.

README.md

@@ -101,6 +101,16 @@ intercepted at the browser level and served from fixtures in
 unrecognised outbound requests are reported as failures rather than silently
 allowed.
 
+That reporting has one bound worth knowing. Observation ends when the browser
+context is torn down, and nothing can watch traffic after that, so the run keeps
+collecting for a fixed grace period after the last test returns
+(`TRAILING_WATCH_MS` in `tests/e2e/run.js`, currently 1500ms) and then closes
+the context. A request whose _first_ dispatch falls after that window is never
+seen at all and cannot fail the run. In practice a request a test fires without
+awaiting reaches the route handler about 10ms later, and anything on a repeating
+timer gets observed on an earlier tick during the ~20s suite — but a one-shot
+call deliberately deferred past the window will escape.
+
 That interception covers the MV3 background service worker as well as the popup
 page, which it does not by default — `script/test-e2e` sets
 `PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is