DAST Conductor Migration: Improve page stability and wait logic
## Summary
Improve the page stability detection and wait logic to handle SPAs (Angular, React) and dynamic content correctly after the Conductor migration. The current `waitForPendingRequests()` and `PageIsReady()` implementations may not correctly detect when pages are fully rendered.
## Background
`waitForPendingRequests()` polls `document.readyState`. For SPAs this is insufficient — the document is `"complete"` but Angular/React are still rendering. `PageIsReady()` uses a 500ms DOM mutation quiescence window which may be too short for some fixture applications. The `end-to-end test 3/11 [arm64]` timed out, suggesting a crawl that loops or hangs waiting for page stability.
## Implementation
### Configurable Quiescence Window
**Files:** `scanner/browser/conductor_adapter.go`, `scanner/browser/page_stability_service.go`
- [ ] Add a configurable quiescence window (default 500ms, tunable via config)
- [ ] Expose the quiescence window as a scanner configuration option
- [ ] Add unit test: custom quiescence window is applied correctly
### Enhanced Wait Logic
**Files:** `scanner/browser/conductor_adapter.go`
- [ ] In `waitForPendingRequests()`: after `readyState === "complete"`, also wait for DOM mutations to settle using `GetDOMMutationSummary().LastMutationTimestamp`
- [ ] Add timeout protection to prevent infinite waits
- [ ] Add integration test: page with a delayed DOM update (via `setTimeout`) causes `PageIsReady()` to return false until the mutation settles
### SPA-Specific Handling
- [ ] Verify Angular route changes are detected via DOM mutation observer
- [ ] Verify loading modals that dismiss after delay are handled
- [ ] Add integration test: SPA route change triggers DOM mutation detection
### Timeout Investigation
- [ ] Investigate `end-to-end test 3/11 [arm64]` timeout — is it resource constraint or crawl hang?
- [ ] Set `RUNNER_SCRIPT_TIMEOUT: 15m` for this group as a temporary fix
- [ ] Add safeguards against infinite wait loops in page stability detection
## Acceptance Criteria
- `PageIsReady()` correctly detects when SPA pages are fully rendered
- Configurable quiescence window works
- No infinite wait loops or crawl hangs
- `waitForPendingRequests()` waits for both `readyState` and DOM mutation settlement
- e2e test 3/11 does not time out
## Testing
- Unit test: configurable quiescence window
- Integration test: delayed DOM update detection
- Integration test: SPA route change detection
- e2e test 3/11 passes without timeout
issue