Add reproducible P0 Matrix browser contract probe

[shenjiecode]

Problem

The target Web assumes that a browser served from the Tiangong origin can use the standard Matrix Client-Server API directly. Current documentation does not preserve a reproducible browser-level proof for CORS, login/session identity, sync/history, media, transaction replay, or raw event relation/reference preservation.

Scope

Create a dependency-free focused P0 probe that:

• uses an owned disposable Matrix Human and room;
• serves a local test page from a distinct Web origin;
• performs Matrix login, whoami, room join/list, sync, history, send, and authenticated media upload/download from the browser;
• retries one exact Matrix transaction ID and proves one event ID/effect;
• sends and reads back a standard reply relation plus a namespaced probe reference;
• proves the Matrix sender remains the disposable Human;
• records console/network errors without retaining credentials or unrestricted event bodies;
• revokes the browser session, deactivates the disposable account, removes the room/alias if owned, and verifies cleanup.

Worker reply delivery and target-runtime Work/outbox behavior remain separate probes unless this slice can prove them without broadening ownership.

Acceptance

• deterministic contract tests cover allowed, denied, replay, malformed result, and cleanup paths;
• the real browser run records direct browser/Matrix facts and a screenshot or snapshot as secondary UI evidence;
• no Matrix password/token is printed, committed, placed in URL/query parameters, or retained after cleanup;
• all owned resources are absent or revoked after the run;
• repository, Skills, Worker baseline, observability, DCO, and secret checks pass.