fix(stealth,hygiene): per-session stealth coverage + orphaned temp-profile sweep

Stealth coverage (the fork's core value was leaking on secondary surfaces):
- stealth scripts are registered per CDP session, so new tabs (`tab new`) and
  cross-origin iframe sessions created after the initial page had NO patches.
  Extract apply_stealth_via_mgr/apply_stealth_to_session and re-apply on
  tab_new and on iframe attach. Fixes automation markers (and FullLaunch UA)
  leaking in new tabs / cross-origin frames.

Resource hygiene (temp profiles filled the disk):
- ChromeProcess::drop already cleans the temp user-data-dir on normal exit, but
  a hard kill (kill -9 / version-mismatch restart / crash) skips Drop and leaks
  ~50MB per session. Add cleanup_orphaned_chrome_profiles() on daemon startup
  that sweeps agent-browser-chrome-* temp dirs NOT referenced by any live
  process (so an in-use profile is never deleted).

cli/src/native/daemon.rs

@@ -59,6 +59,10 @@ pub async fn run_daemon(session: &str) {
         }
     }
 
+    // Sweep temp Chrome profiles leaked by hard-killed daemons (Drop doesn't
+    // run on kill -9). Only removes dirs no live process references.
+    super::cdp::chrome::cleanup_orphaned_chrome_profiles();
+
     let pid_path = socket_dir.join(format!("{}.pid", session));
     let _ = fs::write(&pid_path, process::id().to_string());