Harden image admission, resource recovery and session renewal

Add exact-image compatibility policy, experimental admission, paginated build history and shared reauthentication checks. Preserve uncertain Docker creation records, bound frontend resource waits and renew runtime sessions proactively.

Lazy-load and split Monaco, add regression and opt-in live Docker fault tests, and record full race and real-browser acceptance results.

internal/api/runtime_session.go

@@ -34,15 +34,23 @@ const runtimeSessionJS = `(function () {
  let pending;
  async function renew() {
   if (pending) return pending;
-  pending = (async function () {
+  const run = async function () {
+   // Renew proactively: a successful /me does not extend the five-minute
+   // access lifetime. Web Locks serialize cookie rotation across pages.
    const csrf = document.cookie.split("; ").find(c => c.startsWith("dsh_csrf="));
    if (!csrf) return;
    const response = await fetch("/api/refresh", {method:"POST", credentials:"same-origin", headers:{"X-CSRF-Token":csrf.slice(9)}});
-   if (response.status === 401 || response.status === 403) {
-    const check = await fetch("/api/me", {credentials:"same-origin"});
-    if (check.status === 401) location.reload();
+   if (response.status === 401 || response.status === 403 || response.status === 409) {
+    for (const delay of [0, 100, 250, 500]) {
+     if (delay) await new Promise(resolve => setTimeout(resolve, delay));
+     const check = await fetch("/api/me", {credentials:"same-origin"});
+     if (check.status !== 401) return;
+    }
+    if (response.status === 401 || response.status === 403) location.reload();
    }
-  })().catch(function () {}).finally(function () { pending = undefined; });
+  };
+  pending = (navigator.locks ? navigator.locks.request("dsh-session-refresh", run) : run())
+   .catch(function () {}).finally(function () { pending = undefined; });
   return pending;
  }
  setInterval(renew, 240000);