test: delete the unreachable seal() hook and guard non-object RPC bodies

Three review findings, no redesign.

seal() was installed after session.close(), so onLate could never fire:
once the context is destroyed no route handler and no console listener
exists to record anything. It was dead code that the attribution table,
run.js and harness.js all described as the final safety net. Deleted
rather than moved — take() already drains everything the collector holds
before teardown, so it covered nothing, and this harness must not ship a
mechanism it cannot demonstrate. The now-unreachable `late > 0` term in
the failure condition goes with it.

handleRpc() parsed `postData || "null"` and then dereferenced the result,
so a POST whose body Playwright reports as null — a bodyless request, or
any payload it cannot decode as UTF-8, e.g. sendBeacon with a Blob —
threw a TypeError inside the route handler and killed node mid-suite:
truncated TAP, no summary, no failure line. Non-object payloads now take
the same path as unparseable ones and are reported as unstubbed traffic,
which is the entire point of that branch.

README claimed unrecognised outbound requests are reported as failures,
unqualified, while observation in fact ends TRAILING_WATCH_MS after the
last test returns. The limit is now stated where it lands.

tests/e2e/harness.js

@@ -52,28 +52,22 @@ function isAllowed(text) {
 //
 // So there is no window left to fall outside of. take() is the only
 // reader and it always takes everything outstanding, so successive takes
-// partition the entire record stream with no gaps. seal() closes the
-// stream once the run is over and routes anything later straight to a
-// callback rather than into a list nobody reads again. Attribution is
-// therefore total by construction, and the runner turns every attributed
-// record into a failure.
+// partition the entire record stream with no gaps, and the runner turns
+// every record it reads into a failure.
+//
+// Observation ends when the browser context is closed. Nothing records
+// after that — the route handler and the console listeners are gone with
+// the context — so there is no post-teardown phase to collect, and this
+// class deliberately offers no mechanism pretending to cover one.
 class ErrorCollector {
     constructor() {
         this.entries = [];
         this.taken = 0;
-        this.onLate = null;
     }
 
     record(kind, text) {
         const line = kind + ": " + String(text).split("\n")[0];
         if (isAllowed(line)) return;
-        if (this.onLate) {
-            // Sealed: no test and no suite phase is left to attribute
-            // this to, so hand it over now instead of accumulating it
-            // where nothing will look.
-            this.onLate(line);
-            return;
-        }
         this.entries.push(line);
     }
 
@@ -84,11 +78,6 @@ class ErrorCollector {
         this.taken = this.entries.length;
         return out;
     }
-
-    // Close the stream: later records go to onLate instead of the list.
-    seal(onLate) {
-        this.onLate = onLate;
-    }
 }
 
 function attachErrorListeners(ctx, errors) {