Fixes several state-machine bugs in the redirect/fallback logic found during an external code audit:
- A stale watchdog or network event could, in a narrow timing window, redirect the tab away from a navigation that had already been superseded by a newer one (e.g. during a same-instance self-redirect).
- A hard HTTP failure (401/403/408/429/5xx) could, in some cases, silently abandon the fallback attempt instead of trying the next instance or showing the terminal failure page.
- A Cloudflare challenge response (403 status) was being treated as an immediate instance failure instead of being given a chance to resolve.
- The 45-second fallback time limit could be exceeded by up to ~20 seconds in one edge case.
No user-facing changes to permissions, instance list, or the popup.