feat: vendor and censor the phishing blocklist at build time (closes #219)

script/test-e2e

@@ -59,12 +59,12 @@ main() {
     #   browser profile.
     # PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
     #   ctx.route() intercepts page requests only, and every fetch made by
-    #   the MV3 background service worker — including the phishing
-    #   blocklist fetch that src/background/index.js issues at worker
-    #   startup — goes to the real internet. The flag is experimental and
-    #   Playwright may drop or rename it. It cannot break silently: the
-    #   harness probes service-worker interception at launch and aborts
-    #   the whole suite if it is not in effect (see the interception
+    #   the MV3 background service worker — the JSON-RPC calls behind
+    #   every approval the suite drives among them — goes to the real
+    #   internet. The flag is experimental and Playwright may drop or
+    #   rename it. It cannot break silently: the harness asks the worker
+    #   for one request of its own at launch and aborts the whole suite
+    #   if it does not reach the route handler (see the interception
     #   canary in tests/e2e/harness.js). If a future Playwright removes
     #   the flag, that probe is what will fail, and the fix is either a
     #   replacement mechanism or an honest downgrade of the isolation