[brynary]

BrowserSim and Whirl previously saved different state files. Both now read and write whirl-state version 1 in *.state.json, so a captured state can move between the engines without conversion. A real BrowserSim → Whirl → BrowserSim test verifies cookies, localStorage, sessionStorage, IndexedDB records, binary aliases, and deleted auto-increment key history.

Stacked on #47 (cli-settings). The BrowserSim counterpart is local commit b0b0736 (Adopt shared Whirl browser state format).

• Add the shared JSON schema, fixtures, strict validation, and IndexedDB codec to both repositories. Old state formats require recapture.
• Restore state before application code runs. Capture all visited top-level origins in Whirl without application requests, including origins controlled by a service worker.
• Preserve cookie scope, expiry, metadata, and the redaction flag. Report expired-cookie and redacted-state notices without exposing values.
• Save atomically with mode 0600. Reject output aliases of input files, including symlinks and hard links.
• Document explicit v1 limits: only the main page's sessionStorage is supported; partitioned cookies are rejected; BrowserSim restores one app storage origin. Unsupported state fails before the app runs.

Validation:

• mise run check passes in Whirl, including six new real CLI browser tests and shared-state validation/file-writing tests.
• BrowserSim's pinned acceptance suite passes: type checking, 273 browser tests, and production Next.js coverage. Two opt-in browser tests are skipped in that suite.
• After the final storage-key and replay-scope fixes, 37 focused BrowserSim state/privacy/reload tests pass.
• The opt-in BrowserSim → Whirl → BrowserSim round trip passes against the built Whirl CLI, including storage keys that shadow native methods and an IndexedDB database with an empty name.