fix(sdk): capture cannot change the app's outcome, and both SDKs coordinate on one page - #2442

🟢 Confidence 10/10 · safe to merge. All 23 reviewable files of this PR read at 95f60d2; the kickoff's since-then list names audit-log and service-map files this PR does not touch, so those went unread here.
_{no findings · tests covered · risk medium}

Hardens both published browser SDKs: capture can no longer change an app's fetch/XHR outcome, session events are stamped when they happen, and the two SDKs share one page-wide error, vitals and consent state. Behaviour is pinned by new tests in each package; safe to merge.

• emit stamps timestamp, URL and trace id as an event is buffered, not at flush
• Effect client claims errors page-wide in captureException and notifies page error listeners
• init() runs on defaults and returns a no-op handle when startup throws
• Effect client leases webVitals, gates replay on isLikelyBot, and removes its sanitizer on stop

Production impact

_{95f60d2 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}