Sync runtime with upstream fix wave: phone normalization (IT default), enrichment coordinates, export blacklist suffix-match, orphan-window cleanup, single-flight extraction guard, payload schema validation, least-privilege manifest

- Italian 06/07 landlines normalize to +39 by default (were mis-tagged +33)
- Business coordinates now propagate through detail enrichment (radius filter coverage)
- Export email blacklist uses suffix matching (legit addresses no longer dropped)
- Popup windows swept at every search lifecycle boundary (no orphans after crash/finish)
- Website extraction is single-flight; retry storms can't spawn duplicate worker pools
- MAIN-world detail fetcher schema-validates postMessage payloads before fetching
- Manifest: dropped http://*/* host permission (all scraping is HTTPS) and dead WAR block
- In-flight jobs persist across browser restarts (queue Set->Map fix)
- CSV exports ship a UTF-8 BOM; assorted UI response-shape fixes
- Library hygiene: lean geo utils, bounded email cleanup, mutex acquire timeout