fix: AutistMask does not run in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own. A
popup there could save between the background's read and its write of the
stored record, and undo a network switch the background had saved.

manifest/firefox.json now sets "incognito": "not_allowed", so Firefox never
runs AutistMask in a private window. tests/manifest.test.js pins the key.
The README and five code comments no longer describe a private-window
exception to the lock.

Model: opus-5-5

tests/support/navigatorLocks.js

@@ -4,9 +4,8 @@
 // the callback settles, whether it resolved or rejected. That is what the
 // browser's own does for the one call the extension makes,
 // `navigator.locks.request(name, callback)`. Every module a test file loads
-// shares it, as the extension's background and its pages share the browser's,
-// except a page in a Firefox private window (README, "Stored state and its
-// version").
+// shares it, as the extension's background and its pages share the browser's
+// (README, "Stored state and its version").
 //
 // Run before each test file by `setupFiles` in package.json.