feat(scripts): migrate capture tooling to TypeScript and add Proxyman HAR workflow

Consolidates the validation/capture scripts under TypeScript and adds
a full Proxyman HAR normalization + scenario runner pipeline. No
runtime plugin behavior changes.

Migrations (.js/.mjs -> .ts)
- scripts/mock-upstream.js -> scripts/mock-upstream.ts: uses the Node
  typed HTTP mocks and imports shared fingerprint fixtures from the
  TS sources directly instead of re-parsing.
- scripts/rotation-test.js -> scripts/rotation-test.ts: typed state
  machine for rotating test sessions.
- scripts/validation/proxy-capture.mjs -> scripts/validation/proxy-capture.ts:
  typed MITM proxy with shouldMitmHost and shouldUseBunRuntime
  helpers. shouldMitmHost restricts MITM to api.anthropic.com,
  console.anthropic.com, and claude.ai exact-host matches so the
  proxy never intercepts unrelated subdomains.
- scripts/qa-parallel.sh: updated to spawn mock-upstream via bun
  instead of node.

New
- scripts/proxyman/normalize-har.ts: parses a Proxyman HAR export and
  emits a normalized capture ready for run-live-verification's
  --og-capture / --plugin-capture flags. Exposes loadHarCaptures,
  normalizeHarEntry, selectCapture, and parseArgs for unit testing.
- scripts/proxyman/run-scenario.ts: orchestrates a full Proxyman
  scenario: start the proxy, trigger the client, stop the proxy, run
  normalize-har, feed the result into run-live-verification.
- scripts/validation/cch-validation-2026-04-11.md: human-readable
  note on the CCH validation procedure (no secrets).
- scripts/validation/capture-plugin-bytes.ts: small tweak to match
  the new proxy-capture TS shape (max_tokens 64000, stream true) to
  exercise the full streaming pipeline during capture.

Tests
- tests/unit/proxyman/normalize-har.test.ts: round-trip HAR fixture
  to normalized capture, including the 'first valid capture' and
  'filter by URL' selectors.
- tests/unit/validation/proxy-capture.test.ts: host-targeting and
  runtime-selection guards.
- tests/unit/analysis/extract-fingerprint.test.ts: malformed template
  fragment rejection in the extracted headers.

.gitignore now excludes scripts/validation/proxy-certs/ so the local
MITM CA (generated by proxy-capture on first run) is never committed.

7/7 scoped tests pass.