fix(test): use unique user-data-dir per browser to prevent SingletonLock

Each stealth test now creates a temp dir for Chrome's user data,
preventing profile lock conflicts when tests run in parallel.

Rebrowser Bot Detector results (live test):
- 9/10 PASS, 1 known flag (navigatorWebdriver=undefined flagged
  as "manually deleted" — expected tradeoff vs setting to false)
- Runtime.enable leak: NOT DETECTED
- Source URL leak: NOT DETECTED
- Viewport: PASS (1920x1080, not automation defaults)
- CSP bypass: NOT DETECTED
- Playwright init scripts: NOT DETECTED

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: copyleftdev

Cargo.lock

@@ -35,5 +35,6 @@ palimpsest-storage = { path = "../palimpsest-storage" }
 palimpsest-replay = { path = "../palimpsest-replay" }
 futures = "0.3"
 serde_json = { workspace = true }
+tempfile = { workspace = true }
 tokio = { workspace = true, features = ["rt", "macros"] }
 wiremock = { workspace = true }

crates/palimpsest-fetch/Cargo.toml

@@ -26,14 +26,17 @@ use futures::StreamExt;
 use palimpsest_core::types::CrawlSeed;
 
 /// Build a stealth-hardened browser matching Palimpsest's stealth mode.
+/// Each instance uses a unique user-data-dir to prevent SingletonLock conflicts.
 async fn launch_stealth_browser(
-    seed: CrawlSeed,
+    _seed: CrawlSeed,
 ) -> Result<(Browser, tokio::task::JoinHandle<()>), Box<dyn std::error::Error>> {
+    let data_dir = tempfile::tempdir().map_err(|e| format!("tempdir: {e}"))?;
     let config = BrowserConfig::builder()
         .no_sandbox()
         .arg("--headless=new")
         .arg("--disable-gpu")
         .arg("--disable-dev-shm-usage")
+        .arg(format!("--user-data-dir={}", data_dir.path().display()))
         .arg("--disable-background-networking")
         .arg("--disable-default-apps")
         .arg("--disable-extensions")