Model cookie scope and expiry in isolated actor sessions

[aleff-github]

Problem

IsolatedActorCookieJar currently stores cookies by origin and cookie name. It parses the first name=value pair from Set-Cookie, but does not model browser cookie scope and lifetime attributes such as Path, Expires, or multiple same-name cookies with different paths.

Origin isolation already prevents cross-origin credential reuse, so this is primarily a replay-correctness issue rather than a cross-origin leak.

Why it matters

The current behavior can diverge from browser/Burp session semantics:

• a path-scoped cookie can be sent to unrelated paths on the same origin;
• an expired cookie can remain active when deletion is expressed through Expires rather than Max-Age;
• two cookies with the same name but different paths collapse into one value;
• workflow mutations can therefore produce false positives or false negatives when session state depends on cookie scope.

Proposed direction

• store cookie records with at least name, value, origin/domain, path, secure flag, expiry/max-age, and creation order;
• apply RFC 6265-style path matching and expiry before each request;
• preserve conservative origin binding for explicitly configured actor credentials;
• support same-name cookies with different paths and deterministic header ordering;
• add regression tests for path scoping, expiry/deletion, secure transport, and same-name path collisions.

This should remain deterministic and local; no external cookie/session service is needed.