test: exercise direct browser imports without credentials (#2501)

- [x] I understand that this repository is auto-generated and my pull
request may not be merged

## Changes being requested

- Run the existing `browser-direct-import` Puppeteer fixture in ordinary
credential-free ecosystem checks against the actual packed and installed
SDK, using its existing native browser ESM import of `index.mjs` without
an import map.
- Fail promptly on browser page/module-loading errors, reject and abort
every off-origin request in non-live mode, and verify that browser
API-key protection remains enabled by default with a synthetic
credential.
- Preserve the existing live browser fixture, direct credential-backed
invocation, and immutable origin-scoped credential preload.

## Verification

- `pnpm build`
- `pnpm lint`
- `pnpm exec tsc --noEmit`
- `npm run tsc` in `ecosystem-tests/browser-direct-import`
- `./scripts/test tests/ecosystem-cli.test.ts
tests/ecosystem-browser-credential-security.test.ts` (24 tests)
- Real headless Chrome against current `main`: fails immediately with
`Failed to resolve module specifier "#x509-transport-state"` before any
API request.
- Real headless Chrome with only an ignored installed-package simulation
of the separate production fix: passes the credential-free native-import
and default browser API-key-protection check.
- Three adversarial review rounds, including dedicated browser
credential/network security review; the final two independent
two-reviewer rounds were clean.

## Additional context & links

- Regression coverage for #2494.
- Depends on the independently reviewed production fix in #2495. Until
#2495 merges into `main`, this new real-browser ecosystem regression
intentionally exposes the existing failure; this PR does not include or
stack on that production fix.