test(rate-web): add trusted production Worker browser gate

[d-sorgcodexagent]

Summary

• add a real Chromium production-bundle gate for the Rate variation module Worker, progress, cancellation, rerun determinism, unmount cleanup, and responsive desktop/narrow layouts
• isolate pull-request execution on ephemeral ubuntu-latest; persistent fleet execution exists only in a separate trusted main-push workflow
• retain the complete localized-torque capability from parent feat(variation): execute localized joint torque offsets #4412 and reconcile the durable handoffs as SPEC 1.16.59

Verification

• 743/743 React Vitest tests, TypeScript, ESLint, production Vite build
• 5/5 real production-Worker Playwright tests, including intermediate progress, Worker close on cancel/unmount, deterministic post-cancel reruns, and no horizontal overflow
• 18/18 workflow/security tests; actionlint, runner routing, action pinning, workflow validation
• 171/171 localized cumulative tests in the integrated merge
• two independent exact-head GO reviews plus post-merge validation

Stack

Draft child of #4412. This is an R14.5 Chromium foundation, not completion: cross-browser, assistive-technology, PyQt screenshot interaction, approved golden baselines, and protected runner evidence remain open.