brand-string sweep: 11 files, remove leaked upstream product names

[mdheller]

Audit found 13 places where Firefox 150 fork / LibreWolf-mirror / Firefox ETP strict / Firefox Downloads etc. shipped in user-visible or shipped-code contexts (README marketing, package metadata visible via apt show / winget show / snap info / rpm -qi, and shipped module strings a curious user opens in DevTools).

Fixed (11 files)

• README.md — top-of-repo marketing lines
• settings/actors/BearCaptureParent.sys.mjs — JSDoc 'via Firefox's download manager'
• settings/extensions/registry.json — 5 rationale strings (Firefox ETP strict, Firefox native HTTPS-only, Firefox Downloads, Firefox layout.css, Firefox ETP strict ships Disconnect list)
• packaging/linux/deb/control — 'built on Firefox 150'
• packaging/linux/rpm/bearbrowser.spec — 'Firefox 150 fork'
• packaging/linux/snap/snapcraft.yaml — 'built on Firefox ESR'
• packaging/linux/binary-source.env — 'Firefox 150 fork'
• packaging/chocolatey/README.md — 'installs Firefox ESR'
• packaging/RELEASE.md — 'Mozilla BearBrowser', 'Firefox 150 fork (LibreWolf mirror)', 'Firefox-ESR fallback'
• packaging/oci/README.md — 'LibreWolf-derived workspace'
• packaging/winget/manifests/s/SourceOS/BearBrowser/150.0.1/SourceOS.BearBrowser.locale.en-US.yaml — ShortDescription + Description parenthetical + firefox tag

Kept (attribution — not leaks)

• hostname strings the monitor blocks by NAME (aus5.mozilla.org etc.)
• XPCOM contract-ids (@mozilla.org/binaryinputstream;1)
• extension IDs (react-devtools@mozilla.org, firefox@tampermonkey.net)
• MPL 2.0 copyright headers
• Chocolatey LICENSE.txt (MPL requires attribution)
• gecko-patches/ (patches ARE against Firefox source; naming is correct)
• README.md:69 meta-policy line ('Upstream engine names such as LibreWolf, Firefox, Mozilla, and Gecko are allowed as provenance')

Regression guard

• scripts/verify-brand-strings.sh — 11-file checklist, greps for the exact banned patterns
• .github/workflows/brand-string-sweep.yml — fires on any change to README, settings/actors/, settings/extensions/, packaging/, or the script

Meta: any 'sweep' PR must land its own regression check in the same commit, otherwise the sweep undoes itself in months.

Adversarial-review checklist

• Sensitive network fetches — N/A
• String parsers — N/A
• Packaged-artifact assertions — the check IS an assertion
• FINAL_TARGET_FILES — N/A
• Auth / IAM changes — N/A
• Version metadata — N/A
• Silent-skip guards — check exits non-zero on any regression
• Firefox/Mozilla/LibreWolf strings — this IS the sweep

Test plan

• bash scripts/verify-brand-strings.sh → brand-string sweep: OK
• CI will exercise the same on push + PR.