fix: AutistMask does not work in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own, so a popup there could save between the background's read and its write and undo a network switch the background saved. `manifest/firefox.json` now sets `"incognito": "not_allowed"`, so such a page cannot read or write extension storage, and `tests/manifest.test.js` pins the key. README and the user guide say AutistMask does not work in Firefox private windows. Chrome needs no change: in its default incognito mode an extension page shares the background's lock.

A Firefox user on "Never remember history" can no longer run AutistMask at all.

Model: opus-5-5

tests/stateWriteLock.test.js

@@ -6,9 +6,8 @@
 // now holds a lock from its read to its write.
 //
 // The popup and the background run here as the real modules over one shared
-// storage stub, and share the lock the way the background and a page outside
-// a Firefox private window share the browser's
-// (tests/support/navigatorLocks.js).
+// storage stub, and share the lock the way the background and its pages share
+// the browser's (tests/support/navigatorLocks.js).
 
 const { makeStorageStub } = require("./support/storageStub");