Add idempotency-key replay oracle

[AngelGalindo7]

Summary

• New src/agent/oracles/idempotency.js replays committed POST/PUT requests that carry an idempotency key header and fires IDEMPOTENCY_VIOLATION (auto-assert, high) when the replay returns a distinct non-null resource id
• src/browser/network.js now captures three idempotency key header names alongside auth headers; x-request-id excluded (correlation header, not an idempotency key)
• tryExtractCreatedId moved from an unexported local in crossLayer.js to an export in src/perception/resourceId.js — shared by both oracles
• Oracle wired at the step boundary in src/index.js with a per-arm maxReplaysPerRun counter; disabled in passive mode via applyPassivePatch

Test plan

• POST with matching idempotency key, original id ≠ replay id → IDEMPOTENCY_VIOLATION
• POST with matching key, original id = replay id → silent
• POST without idempotency key header → silent
• POST with status 204 (excluded from COMMITTED_STATUSES) → silent
• enabled: false → silent, no fetch issued
• Non-first-party domain → silent
• x-idempotency-key and custom keyHeaders variants → fire correctly
• maxReplaysPerRun: 1 with two qualifying captures → fires only once
• Shared replayCount ref persists across step calls; network errors do not consume a slot
• x-request-id-only request → silent (correlation header, not a dedup key)

Known gaps

Cached-response masking (server returns first response verbatim, second row still created), server-rotated key patterns, and 204 responses are silent by design; documented in source and DECISION_LOG 020.