Appended the stealth iframe to documentElement when document.head is not available during new-document evaluation.
Added regression coverage for the null-head bootstrap path.
Fixes#1267
Keep the active page stealth setup synchronous, but make the broader CDP target UA override sweep selective and best-effort. Non-page or ephemeral Chrome targets can otherwise block worker initialization long enough for browser.open to hit the tool timeout before the tab worker sends ready.
Fixes#1053