fix: pin the bundled Camoufox build to 152.0.4-beta.31

[ryanduguid]

Summary

Pin the bundled Camoufox download to 152.0.4-beta.31. Camoufox 156.0.1-beta.34 became the latest stable release at 22:03 UTC on 3 October. camoufox-js 0.11.5 still generates config properties that 156 removed, such as navigator.product, so every launch on a fresh install fails with Unknown property navigator.product in config. Master run 37170178094 failed this way in e2e (24), windows-e2e and windows-process-cleanup; the previous green run fetched 152.0.4-beta.31.

  postinstall.js / npm run fetch-bin
    downloadBundledCamoufox()
-     new CamoufoxFetcher()          // latest stable release
+     new PinnedCamoufoxFetcher()    // only 152.0.4-beta.31, searches 100 releases

fetch-bin now runs scripts/fetch-camoufox.js, because npx camoufox-js fetch would install 156 again. The remediation messages in postinstall.js, server.js, run.sh and README.md point to npm run fetch-bin.

camoufox-js 0.12.0, the latest on npm, keeps the same property mapping. apify/camoufox-js#339 filters the generated keys but is unmerged. Raise the pin and camoufox-js together once a release supports 156.

Evidence

• Before: master run 37170178094 logs camoufox launch attempt failed ... Unknown property navigator.product in config on every launch.
  After: on Linux (Node 26, private CAMOUFOX_INSTALL_DIR), npm run fetch-bin installed {"version":"152.0.4","release":"beta.31"} and the e2e config passed 15 suites, 80/80 tests, with no Unknown property lines.
• scripts/postinstall.test.js passed 4/4, including a new test that the fetcher accepts the pinned asset and rejects 156.0.1-beta.34.

Merge danger

Door: two-way. Blast radius: browser installs

New installs and npm run fetch-bin get 152.0.4-beta.31 instead of the latest release. Existing caches are unchanged.

Unverified

• Windows jobs were not run locally. The pinned release includes win.x86_64 and win.i686 assets; this PR's CI covers them.
• On the Linux test machine, four tests/unit/security.test.js cases time out on POST /tabs and the yt-dlp install test fails without shasum. Master fails the same four security cases there with the same browser build, and CI passed them on 3 October.