fix(verifiers): centralize failure and cleanup ownership

Own operation results and exact rejections in withVerifierCleanup, including
undefined, null and independent cleanup failures. Remove the optional-primary
cleanup contract and migrate every caller, preserving returns, annotations,
signal restoration and dependent cleanup order.

Make Frida/JEB reporters fail on reasonless rejections and retain JEB fixture
files while provider cleanup is incomplete. Own the nested packaged WASM
verifier and expose its composite process/root cleanup capability for retry.
Update runnable docs and isolated fixture dependencies.

Validation: 547 focused cases in 20 files, eight isolated boundary unit checks,
static/build/docs/discovery gates and duplication check (3.58%). Node process,
SDK and descriptor cleanup are exercised; provider and packaging results in
orchestration tests are simulated. Pack/install subprocess ownership remains
with the existing shared package runner outside the nested-command change.

scripts/lib/browser-runtime-e2e.mjs

@@ -17,7 +17,7 @@ import { startBrowserRuntimeSite } from "../fixtures/browser-runtime-site.mjs";
 import { requireOrdinaryWindowsVerifierCaller } from "./windows-ordinary-user-verifier.mjs";
 import { mcpTextValue } from "./mcp-verifier-results.mjs";
 import { startRuntimeFixtureBrowser } from "./browser-runtime-fixture-lifecycle.mjs";
-import { closeVerifierResources } from "./verifier-cleanup.mjs";
+import { withVerifierCleanup } from "./verifier-cleanup.mjs";
 import { verifyRuntimeTargetTermination } from "./browser-runtime-termination-e2e.mjs";
 import { verifyRuntimeInvalidSelectors } from "./browser-runtime-selector-e2e.mjs";
 import {
@@ -40,10 +40,9 @@ export async function verifyBrowserRuntime(
   await access(executable);
   const site = await startBrowserRuntimeSite();
   let fixture;
-  let primaryError;
   let action;
   let client;
-  try {
+  return withVerifierCleanup(async () => {
     fixture = await startRuntimeFixtureBrowser(executable, site.origin);
     const endpoint = `http://127.0.0.1:${fixture.port}`;
     const targets = await new CdpBrowserProvider().listTargets(
@@ -176,20 +175,12 @@ export async function verifyBrowserRuntime(
       fresh_mcp: freshMcpProof,
       page_remained_open: true,
     };
-  } catch (cause) {
-    primaryError = cause;
-    throw cause;
-  } finally {
-    await closeVerifierResources(
-      [
-        () => client?.close(),
-        () => action?.close(),
-        () => fixture?.close(),
-        () => site.close(),
-      ],
-      primaryError,
-    );
-  }
+  }, [
+    () => client?.close(),
+    () => action?.close(),
+    () => fixture?.close(),
+    () => site.close(),
+  ]);
 }
 
 async function executionMcp(