fix: AutistMask does not work in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own. A
popup there could save between the background's read and its write of the
stored record, and undo a network switch the background had saved.

manifest/firefox.json now sets "incognito": "not_allowed", so a page in a
private window cannot read or write extension storage. tests/manifest.test.js
pins the key. The README says this in "Stored state and its version". Six
code comments drop their private-window exception to the lock.
docs/README.md tells Firefox users that AutistMask does not work in private
windows.

Model: opus-5-5

README.md

@@ -1494,10 +1494,10 @@ wrote last, the record says which build's shape it is in.
 Each write reads the record, changes it and writes it back, holding a lock from
 the read to the write: the browser's own (`navigator.locks`), taken through
 `withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
-background share it. Firefox gives a page in a private window locks of its own.
-`manifest/firefox.json` sets `"incognito": "not_allowed"`, so such a page cannot
-read or write extension storage. In Chrome, a page opened from an incognito
-window still runs outside incognito and shares the lock. The popup's
+background share it, except a page in a Firefox private window, which has locks
+of its own. `manifest/firefox.json` sets `"incognito": "not_allowed"`, so such a
+page cannot read or write extension storage. In Chrome, a page opened from an
+incognito window still runs outside incognito and shares the lock. The popup's
 `saveState()`, the background's `updateState()` and the StateRecovery reset all
 take it, so no write lands between another write's read and its write, where it
 would be lost. Chrome has it from version 69, older than any Chrome that runs a

docs/README.md

@@ -208,7 +208,8 @@ password.
 3. Click "Load Temporary Add-on".
 4. Select `dist/firefox/manifest.json`.
 
-AutistMask does not work in Firefox private windows.
+AutistMask does not work in Firefox private windows. If Firefox is set to "Never
+remember history", every window is private, so AutistMask does not work at all.
 
 ## Getting Started