fix(cookies): repair StorageActor enumeration on FF152 (httpOnly + flags)

[ractive]

Summary

Implements iteration 121. On Firefox 152 the cookies command silently lost its authoritative StorageActor path — httpOnly cookies were missed entirely and isSecure/isHttpOnly/sameSite/domain were always null; cookies --storage-only returned 0. Confirmed on a clean FF152.0.6 instance in dogfooding-session-61.

• Root cause (found via raw RDP tracing). On FF152 the cookies resources-available-array event arrives before the watchResources ACK. recv_reply_from (iter-74+) routes any typed packet to the transport's event sink and returns only the plain ACK. On the direct cookies command path no sink is installed, so the event was dropped entirely — getStoreObjects was never sent, list_cookies returned empty, and every cookie fell back to document.cookie (exit 0, silently wrong). The FF152 wire contract for the cookie resource and getStoreObjects is unchanged; the bug is purely event-capture message-ordering.
• Theme A — repair enumeration. StorageActor::list_cookies now installs a temporary event-sink collector around the watchResources call via the new RdpTransport::swap_event_sink (restoring any prior sink), finds the cookie store resource from captured events first, then falls back to the inline ACK and one extra recv() for older Firefox orderings.
• Theme B — no silent degradation. commands::cookies::run attaches a warnings[{type:"storage_actor_empty"}] marker (attach_storage_degraded_warning) when the StorageActor path is empty but document.cookie still contributed entries, so a flag-less result is never presented as complete.
• Docs: kb/rdp/actors/storage.md records the FF152 root-cause analysis, the parent-process cookies architecture, and the fix.

Test plan

• live_cookies_httponly_enumerated — after a Set-Cookie: …; HttpOnly; Secure; SameSite=Strict, ff-rdp cookies returns the cookie with isHttpOnly==true and non-null isSecure/sameSite, not sourced from document.cookie. PASS live on FF152.0.6.
• live_cookies_storage_only_nonempty — ff-rdp cookies --storage-only returns >= 1 on a page that set a cookie. PASS (returned 2).
• parse_cookie_store_resource_ff152_shape — parser handles the exact FF152 resource event (with browsingContextID/resourceKey).
• swap_event_sink_returns_previous_and_installs_new — new transport helper preserves/restores the prior sink.
• unit_cookies_storage_degraded_warning_attached + two no-warning cases — Theme B marker logic.
• Recorder live_cookies_httponly + real recorded fixture get_store_objects_cookies_httponly_response.json.
• cargo fmt / cargo clippy --workspace --all-targets -- -D warnings / cargo test --workspace -q all clean.
• cargo run -p xtask -- check-iteration-ready → 10/10 PASS.

🤖 Generated with Claude Code## Claims vs code
<generated 2026-07-19T11:10:07Z by ralph-loop>

• StorageActor::list_cookies → ✅ matched in diff
• RdpTransport::swap_event_sink → ✅ matched in diff