feat(runtime): default managed Chrome to background

[MapleCity1314]

Outcome

• launches the dedicated Mac Chrome profile through LaunchServices hidden and without activation
• requires the installed Google Chrome app to pass codesign, Team ID, bundle ID, and Gatekeeper checks
• supervises the hidden Chrome process from the closure-owned LaunchAgent
• keeps inventory, retired-products, and experience-score workflows on Extension DOM/Tab APIs without OS mouse or keyboard automation

Safety

• direct Chrome launch and unsigned Chrome for Testing both failed the foreground experiment and are not used
• no Trigger is enabled
• no production or real notification is changed
• login, captcha, and risk-control still stop for audited Recovery Session handoff

Verification

• exact Node 24.18.0 pnpm verify
• 158 test files / 1249 tests
• managed Chrome install gates 4/4
• signed Google Chrome LaunchServices experiment kept the foreground ASN unchanged
• git diff --check