fix: AutistMask does not work in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own. A
popup there could save between the background's read and its write of the
stored record, and undo a network switch the background had saved.

manifest/firefox.json now sets "incognito": "not_allowed", so a page in a
private window cannot read or write extension storage. tests/manifest.test.js
pins the key. The README says this in "Stored state and its version". Six
code comments drop their private-window exception to the lock.
docs/README.md tells Firefox users that AutistMask does not work in private
windows.

Model: opus-5-5

README.md

@@ -1494,16 +1494,16 @@ wrote last, the record says which build's shape it is in.
 Each write reads the record, changes it and writes it back, holding a lock from
 the read to the write: the browser's own (`navigator.locks`), taken through
 `withLock()` in `src/shared/browserApi.js`. Every page of the extension and its
-background share it. `manifest/firefox.json` sets `"incognito": "not_allowed"`,
-so no page runs in a Firefox private window. Firefox would give a page there
-locks of its own. In Chrome, a page opened from an incognito window still runs
-outside incognito and shares the lock. The popup's `saveState()`, the
-background's `updateState()` and the StateRecovery reset all take it, so no
-write lands between another write's read and its write, where it would be lost.
-Chrome has it from version 69, older than any Chrome that runs a Manifest V3
-extension, in pages and in the service worker; Firefox from version 96, older
-than the 115 `manifest/firefox.json` declares. Where it is missing, a write
-fails rather than going ahead without it.
+background share it. Firefox gives a page in a private window locks of its own.
+`manifest/firefox.json` sets `"incognito": "not_allowed"`, so such a page cannot
+read or write extension storage. In Chrome, a page opened from an incognito
+window still runs outside incognito and shares the lock. The popup's
+`saveState()`, the background's `updateState()` and the StateRecovery reset all
+take it, so no write lands between another write's read and its write, where it
+would be lost. Chrome has it from version 69, older than any Chrome that runs a
+Manifest V3 extension, in pages and in the service worker; Firefox from version
+96, older than the 115 `manifest/firefox.json` declares. Where it is missing, a
+write fails rather than going ahead without it.
 
 Version 1 is the shape that shipped before versions existed, so a stored record
 with no `schemaVersion` is version 1 rather than a defect: it loads normally and

docs/README.md

@@ -208,6 +208,8 @@ password.
 3. Click "Load Temporary Add-on".
 4. Select `dist/firefox/manifest.json`.
 
+AutistMask does not work in Firefox private windows.
+
 ## Getting Started
 
 ### Creating a New Wallet

tests/manifest.test.js

@@ -169,7 +169,7 @@ describe("declared icons", () => {
 // save could land between the background's read and its write (README,
 // "Stored state and its version").
 describe("private windows", () => {
-    test("firefox never runs AutistMask in a private window", () => {
+    test("a page in a firefox private window cannot read or write extension storage", () => {
         expect(readManifest("firefox").incognito).toBe("not_allowed");
     });
 });