test: intercept the MV3 service worker's network in the e2e harness

ctx.route() does not see requests made by the background service worker
unless Playwright is run with PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1,
so the phishing blocklist fetch that src/background/index.js issues at
worker startup was reaching raw.githubusercontent.com on the real
internet on every run. phishingDomains.js swallows fetch failures, so
nothing surfaced it, and the raw.githubusercontent.com stub in
tests/e2e/network.js was unreachable code that made the gap look covered.

script/test-e2e now sets the flag, with a comment recording what to do if
a future Playwright drops it. The flag being experimental is not taken on
trust: launch() waits for the worker's own startup request to arrive in
the route handler and refuses to run the suite if it never does, so
escaping traffic fails the run instead of passing unnoticed. Chrome is
additionally started with --host-resolver-rules=MAP * ~NOTFOUND, so
anything that does slip past interception cannot reach a real host.

Also: errors and unstubbed requests recorded during launch are attributed
to the first test rather than discarded, a suite that registers no tests
now fails instead of exiting 0, a failure after the browser is up tears
the context down instead of hanging the process, E2E_TRACE_NETWORK=1
prints every routed request tagged [sw] or [page], and the dead exports in
harness.js and network.js are gone.

TODO.md

@@ -32,7 +32,9 @@ review.
   `script/test-e2e`) driving the real popup with all network intercepted, plus
   the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
   and TransactionDetail broken for every ERC-20 transfer (#151). Harness
-  demonstrated failing before the fixes and passing after (#181).
+  demonstrated failing before the fixes and passing after (#181). Interception
+  covers the MV3 background service worker, not just the popup page, and a
+  launch-time canary aborts the suite if worker traffic starts escaping.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
   (#149-#168).
 - 2026-07-26: About well in settings with build info, repo link and the version
@@ -63,9 +65,12 @@ review.
 - Decide the libsodium backend that actually ships (#182) and delete the single
   allowlist entry it owns in `tests/e2e/harness.js`.
 - Extend the end-to-end suite to the dApp approval signing path (EIP-1193
-  through the real content script, background worker and approval popup), and
-  decide separately whether docker-in-docker makes `make test-e2e` runnable in
-  the Gitea workflow.
+  through the real content script, background worker and approval popup). That
+  path needs a CDP-based route to background-worker console output first:
+  Playwright exposes no error event for service workers, so an uncaught
+  exception in the worker cannot fail the run today (worker network traffic is
+  already covered). Decide separately whether docker-in-docker makes
+  `make test-e2e` runnable in the Gitea workflow.
 - Make the Firefox target functional: Chrome callback APIs are used against the
   promise-only `browser` namespace (#153).
 - Send and transaction-flow correctness: gas fee excluded from the