Make HTML debugger transport byte-safe

[sirreal]

Summary

• make exact HTML and fragment-context bytes the source of truth across URLs, REST requests, HTML API processing, previews, results, and copied links
• introduce canonical format=v1 URLs with unpadded base64url byte fields and a strict one-time redirect for legacy links
• recursively envelope response strings so malformed UTF-8 never enters JSON, Interactivity state, or DOM strings directly
• add byte/text inspection, lossless full-document previews, race-safe runtime wiring, and explicit handling for malformed input
• cache-bust the complete browser module graph at version 3.4

Why

The previous Unicode-string transport could silently replace or discard malformed UTF-8, so the debugger could process different bytes from those represented by a URL. The new transport preserves arbitrary bytes end to end while keeping valid UTF-8 workflows convenient.

During browser verification, two native-method receiver bugs were also found and fixed: History normalization now calls replaceState through its history receiver, and default timers call setTimeout/clearTimeout through globalThis.

Validation

• PHP byte transport, legacy URL, REST API, plugin cutover, and WordPress HTML API integration regressions
• Node byte transport, canonical URL, preview, response transport, runtime controller/wiring, UI transaction, and main wiring regressions
• TypeScript --noEmit, PHP syntax, and git diff --check
• persistent isolated-Chrome canonical URL and native-timer browser fixtures
• authenticated end-to-end wp-env check of the reported URL in a fresh isolated Chrome profile: no error banner or exceptions, result and tree present, processed HTML <foo>, HTML API tree HTMLHEADBODYFOO

The untracked docs/ directory is intentionally excluded from this PR.