[CUG] Define browser-node restricted-domain support or fail-closed refusal

[RobLe3]

Problem

Rust, Python and TypeScript have explicit restricted trust-domain parity work, but the experimental browser node has no recorded disposition. Browser storage and relay constraints make silent partial support unsafe.

Desired result

Audit the browser node against the accepted restricted-domain Profile. Implement only a safe supported subset or reject required restricted-domain operation before network activity. Never persist long-lived membership credentials in localStorage.

Acceptance criteria

• Supported and unsupported operating modes are explicit.
• Required unsupported Profile semantics fail before discovery, relay or registration.
• No public fallback occurs for private/local-only configuration.
• Credentials and private topology do not enter browser storage or diagnostics.
• Public experimental behavior remains regression-tested.
• Documentation makes no CUG support claim without shared-fixture and black-box evidence.

Dependencies

Blocked by RobLe3/IICP#53 and the accepted shared configuration/fixture contract.

Non-goals

General browser credential management, GUI work, federation activation or changing public defaults.

[RobLe3]

PR #23 implements the conservative disposition selected for this milestone: explicit fail-closed refusal rather than partial browser CUG support.

It preserves public mode, rejects every explicit non-public mode during construction with restricted_profile_unsupported, and tests that no fetch occurs before refusal. Documentation states that membership credentials are not persisted and that private requests never downgrade to the public directory.

The issue should close only after review/merge and successful required checks. Full browser CUG participation remains deferred pending a separate WebCrypto and credential-lifecycle design.

[RobLe3]

Completed by merged PR #23. Browser consumers and providers now reject explicit non-public modes before network activity, public behavior remains unchanged, and tests/documentation record the fail-closed boundary. Full browser CUG participation remains intentionally deferred.