fix(browser-utils): prevent DOM handler leaks

[DorianChn]

The DOM instrumentation wrapper currently decrements its refcount for every removeEventListener call, including no-op removals. When a capture-phase listener is the first registration, a later bubble-phase no-op removal can reach zero with the wrong capture mode and leave the internal handler attached.

Why: Track actual listener/capture registrations and normalize the internal handler to a stable capture boolean. This prevents unrelated removals from dropping the bookkeeping early and preserves correct cleanup when multiple listeners use different capture modes.

Fixes #24702

Validation: The targeted DOM regression test, browser-utils build, package lint, type-aware lint, targeted format check, and git diff checks pass. The package-wide test run reached 251/252; its only failure was the unrelated networkUtils Request/URLSearchParams mismatch in this local jsdom environment.

[mstevens843]

Hi @DorianChn , I independently tested your dom.ts implementation at c39c75f against additional listener-lifecycle regressions.

All 33 jsdom cases and four Chromium tests pass. The browser tests cover the 20-cycle document-listener leak and missing ui.click breadcrumbs after no-op removals, with and without BrowserApiErrors. All four browser tests fail on the unpatched daacc2bd base.

I have two browser integration suites ready to contribute. Would you prefer to include them in this PR or have a tests-only follow-up after it merges?

Tested locally with Node 22.22.1 and Chromium

[Lms24]

Thanks for contributing! unfortunately this is too large and not a minimal fix (see #24727).