fix: avoid read-only srcdoc assignment in iframe hook

[sjh9714]

Summary

Fixes the iframe srcdoc hook in fixIframeContentWindow() so assigning iframe.srcdoc preserves the assigned value instead of leaving the iframe without srcdoc content.

What changed

• Added a focused Playwright/Vitest regression test that installs the injected contentWindow fix, assigns iframe.srcdoc, and checks both the DOM attribute and property value.
• Updated the one-shot srcdoc setter to store the assigned string on the final descriptor and write it with setAttribute() instead of assigning to the now non-writable property.

Why

The previous hook reset srcdoc as a non-writable own property with the original value, then immediately assigned through _iframe.srcdoc. In Chromium this left the srcdoc attribute unset, and in strict contexts it can throw Cannot assign to read only property 'srcdoc' as described in #546.

Testing

• pnpm install --frozen-lockfile
• pnpm exec playwright install chromium
• pnpm exec vitest run test/fingerprint-injector/fingerprint-injector.test.ts -t "srcdoc" (failed before the fix: srcdoc attribute was null)
• pnpm exec vitest run test/fingerprint-injector/fingerprint-injector.test.ts -t "srcdoc"
• pnpm build
• pnpm lint (passes with existing no-console warnings)
• git diff --check

Fixes #546

Note: I used Codex to inspect the code path and draft the focused regression test, then reviewed the final diff and ran the listed verification commands locally.

[barjin]

Looks alright to me.

Thank you for the test!