Canonical portal-owned shell family for unified browser routes.
Customer runtime remains fail-closed until a valid session is present.