feat: add TLSNotary alpha.15 proving modes

[Step7750]

Summary

• default notary requests to alpha.15 Proxy-TLS with an optional MPC override
• adapt browser WebSockets to the new WASM IoChannel API
• point release environments at the parallel alpha.15 notary stack

Depends on csfloat/tlsn-wasm#9 and csfloat/harpocrates#30.

Ref CSF-1648

---

Note

High Risk
Changes the TLSNotary proving protocol, WASM dependency, and production notary endpoints—core to attested Steam API proofs—with only MPC as an escape hatch.

Overview
Bumps the extension to 5.16.0 and upgrades @csfloat/tlsn-wasm to 0.1.0-alpha.15 via a vendored tarball until npm publish is restored.

Notary TLS/WS endpoints in dev, staging, and production now target the parallel alpha.15 notary hosts instead of the previous production notary URLs.

Proving flow is updated for the new WASM API: prover.setup and send_request use IoChannel instances over WebSockets (verifier URL is derived from the HTTP notary base via toWebSocketUrl). Proxy-TLS is the default prover mode; meta.prover_mode: 'mpc' keeps the legacy path that still opens the notary proxy WebSocket for the Steam request. Request meta gains optional prover_mode typing in NotaryProveRequest.

Adds WebSocketIoChannel plus unit tests for queued reads, EOF on close, and write-after-close behavior. Channels are closed in a finally block alongside the session.

Reviewed by Cursor Bugbot for commit d7a596c. Bugbot is set up for automated code reviews on this repo. Configure here.

---

Note

High Risk
Changes the TLSNotary WASM dependency, proving protocol (default Proxy-TLS), and production/staging notary endpoints—core to attested Steam API proofs—with MPC as the only legacy fallback.

Overview
Upgrades @csfloat/tlsn-wasm to 0.1.0-alpha.15 and retargets notary TLS/WS URLs: production and staging use /v15 on notary.csfloat.com; dev points at localhost:7047.

The offscreen prove path is wired to the new WASM API: prover.setup and send_request take IoChannel instances backed by a new WebSocketIoChannel (verifier URL is opened via toWebSocketUrl). Proxy-TLS is the default Prover mode; meta.prover_mode: 'mpc' keeps the legacy flow that still opens the notary proxy WebSocket for the Steam request. Request meta gains optional prover_mode typing.

Verifier and proxy channels are closed in finally alongside the session. Unit tests cover connect failures, queued reads/EOF, and write-after-close on WebSocketIoChannel.

^{Reviewed by Cursor Bugbot for commit 0c2fdbc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef5c43f. Configure here.}