fix(verifiers): centralize failure and cleanup ownership

Own operation results and exact rejections in withVerifierCleanup, including
undefined, null and independent cleanup failures. Remove the optional-primary
cleanup contract and migrate every caller, preserving returns, annotations,
signal restoration and dependent cleanup order.

Make Frida/JEB reporters fail on reasonless rejections and retain JEB fixture
files while provider cleanup is incomplete. Own the nested packaged WASM
verifier and expose its composite process/root cleanup capability for retry.
Update runnable docs and isolated fixture dependencies.

Validation: 547 focused cases in 20 files, eight isolated boundary unit checks,
static/build/docs/discovery gates and duplication check (3.58%). Node process,
SDK and descriptor cleanup are exercised; provider and packaging results in
orchestration tests are simulated. Pack/install subprocess ownership remains
with the existing shared package runner outside the nested-command change.

scripts/lib/browser-runtime-termination-e2e.mjs

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import { CdpConnection } from "../../dist/browser/CdpConnection.js";
 import { mcpTextValue, requireMcpToolError } from "./mcp-verifier-results.mjs";
-import { closeVerifierResources } from "./verifier-cleanup.mjs";
+import { withVerifierCleanup } from "./verifier-cleanup.mjs";
 
 /** Close a separately owned fixture page after actual MCP arming and inspect native cleanup diagnostics. */
 export async function verifyRuntimeTargetTermination(client, input, origin) {
@@ -14,8 +14,7 @@ export async function verifyRuntimeTargetTermination(client, input, origin) {
   );
   let targetId;
   let closed = false;
-  let primaryError;
-  try {
+  return withVerifierCleanup(async () => {
     ({ targetId } = await root.send("Target.createTarget", { url: origin }));
     assert.equal(typeof targetId, "string");
     await waitForTarget(input.cdp_endpoint, targetId, origin);
@@ -81,21 +80,13 @@ export async function verifyRuntimeTargetTermination(client, input, origin) {
       cleanup: "unconfirmed_reported",
       observed_window_end_reason: "session_detached",
     };
-  } catch (cause) {
-    primaryError = cause;
-    throw cause;
-  } finally {
-    await closeVerifierResources(
-      [
-        () =>
-          targetId === undefined || closed
-            ? undefined
-            : root.send("Target.closeTarget", { targetId }),
-        () => root.close(),
-      ],
-      primaryError,
-    );
-  }
+  }, [
+    () =>
+      targetId === undefined || closed
+        ? undefined
+        : root.send("Target.closeTarget", { targetId }),
+    () => root.close(),
+  ]);
 }
 
 async function waitForTarget(endpoint, targetId, origin) {