test: make e2e error attribution total, and fix the README canary text

The error collector had a window API (mark/since) and twice a record fell
outside somebody's window and was silently dropped, producing a green run
that proved nothing: first the mark started after test 1, discarding
everything recorded during launch; then the tail after the final test was
never read at all, so a request escaping the fixtures at the end of the
last test reported 5/5 passed and exit 0.

Rather than patch a second boundary and invite a third, the window
concept is gone. ErrorCollector exposes only take(), which always drains
everything outstanding, so successive takes partition the whole record
stream with no gaps, and seal(), which closes the stream at the end of
the run and routes stragglers straight to a failure. Attribution is
total by construction: launch through test 1 goes to test 1, each
subsequent interval to the test that ends it, the tail to the suite.

The tail also needs to exist before it can be drained. A request a test
fires without awaiting reaches the route handler about 10ms after that
test's function resolves, and closing the context does not wait for it,
so with no window at all it died unobserved. The run now keeps
collecting for a bounded 1.5s after the last test before teardown.

Also:

- README described a canary that was built, found to kill the service
  worker, and deleted. Replaced with what actually runs: the harness
  waits for the background worker's own startup blocklist fetch to reach
  the route handler and aborts if it does not. Documents
  --host-resolver-rules=MAP * ~NOTFOUND as defence in depth.
- The canary's failure message asserted traffic was escaping to the real
  internet and blamed the -e flag. It cannot distinguish that from a lost
  startup race, so it now states what was observed and lists both causes.
- E2E_TRACE_NETWORK was compared strictly to "1", so E2E_TRACE_NETWORK=true
  silently did nothing. Recognised on/off values are accepted and anything
  else is a hard error rather than a quiet default.
- The measured margin that makes the canary sound is route install at
  11-23ms against the worker fetch at 525-883ms, not the 30s timeout
  slack the comment cited.

tests/e2e/run.js

@@ -20,6 +20,10 @@ const { STUB_TOKEN, STUB_TX_HASH } = require("./network");
 
 const TEST_TIMEOUT_MS = 120000;
 
+// How long to keep collecting after the final test returns; see the
+// trailing drain in main().
+const TRAILING_WATCH_MS = 1500;
+
 const tests = [];
 
 function test(name, fn) {
@@ -152,13 +156,27 @@ async function main() {
         page: null,
     };
 
+    // Attribution of collected errors is total. session.errors has no
+    // window API at all: take() always drains everything outstanding, so
+    // successive takes partition the whole stream, and the phases below
+    // cover the entire life of the run. Nothing the collector holds can
+    // go unread.
+    //
+    //   launch .. end of test 1     -> test 1 (so the worker's startup
+    //                                  fetches land on a test, not
+    //                                  nowhere)
+    //   end of test k .. end of k+1 -> test k+1
+    //   last test .. teardown       -> the suite, via the trailing drain
+    //   after the trailing drain    -> seal(), which fails on the spot
+    //
+    // Two green-but-vacuous runs on this harness were the same shape: a
+    // record falling outside somebody's window and being dropped. First
+    // the mark started after test 1, discarding launch-time records;
+    // then the tail after the last test was never read. Patching a
+    // second boundary would have invited a third, so the window concept
+    // is gone rather than fixed.
     let failed = 0;
     let n = 0;
-    // Starts at zero rather than at the current mark on purpose: errors
-    // and escaping requests recorded during launch — before any test ran,
-    // which is when the background worker does its startup fetches — are
-    // attributed to the first test instead of being discarded.
-    let mark = 0;
     for (const t of tests) {
         n += 1;
         let failure = null;
@@ -168,11 +186,10 @@ async function main() {
             failure = e.message;
         }
 
-        // Any uncaught page error or console.error fails the test that
-        // provoked it, whether or not its assertions passed. This is the
-        // mechanism that caught #150.
-        const newErrors = session.errors.since(mark);
-        mark = session.errors.mark();
+        // Any uncaught page error, console.error or unstubbed request
+        // fails the test that provoked it, whether or not its assertions
+        // passed. This is the mechanism that caught #150.
+        const newErrors = session.errors.take();
         if (!failure && newErrors.length > 0) {
             failure = "uncaught browser errors during this test";
         }
@@ -189,12 +206,58 @@ async function main() {
         }
     }
 
+    // Keep watching after the last test returns, before tearing the
+    // browser down. A request a test fires without awaiting is still in
+    // flight when its function resolves; measured here it reaches the
+    // route handler about 10ms later, but closing the context does not
+    // wait for it — with no window at all the request dies unobserved
+    // and the run goes green, which is exactly how escaping traffic
+    // stays invisible.
+    //
+    // A fixed bounded window rather than a quiescence poll on purpose:
+    // the collector being quiet is not evidence, because a request that
+    // has not been dispatched yet has recorded nothing to be quiet
+    // about. Playwright offers no "is anything in flight" question to
+    // ask either — the route handler is the only observation point — so
+    // a grace period is the mechanism available, and this one is ~150x
+    // the measured latency for 1.5s on a ~25s suite.
+    await new Promise((resolve) => setTimeout(resolve, TRAILING_WATCH_MS));
+
     await session.close();
 
+    // The tail. These cannot be blamed on any single test, so they are
+    // reported against the suite rather than guessed at — but they are
+    // reported, and they fail the run.
+    const trailing = session.errors.take();
+
+    // From here the run is over and there is nothing left to attribute a
+    // record to, so stragglers fail immediately instead of piling up
+    // where nothing will read them.
+    let late = 0;
+    session.errors.seal((line) => {
+        late += 1;
+        console.log("# FAILED: browser error recorded after the run ended");
+        console.log("#   " + line);
+        process.exitCode = 1;
+    });
+
     console.log(
-        "# " + (tests.length - failed) + "/" + tests.length + " passed",
+        "# " + (tests.length - failed) + "/" + tests.length + " tests passed",
     );
-    if (failed > 0) {
+
+    if (trailing.length > 0) {
+        console.log(
+            "# " +
+                trailing.length +
+                " browser error(s) recorded after the last test finished, " +
+                "not attributable to any single test:",
+        );
+        for (const line of trailing) {
+            console.log("#   " + line);
+        }
+    }
+
+    if (failed > 0 || trailing.length > 0 || late > 0) {
         console.log("# FAILED");
         process.exitCode = 1;
     }