Google binds a signed-in session to the browser identity that created it, and
rejected Orca's Electron/Chrome-shaped UA on accounts.google.com — so sessions
died at ~1h and re-copying cookies only reset the same losing clock.
Present a Firefox identity scoped to the Google/YouTube sign-in hosts at every
layer Google probes: the request headers (with sec-ch-ua* stripped, since real
Firefox sends none), the per-WebContents UA that auth JS reads, and the CDP
emulation override a viewport preset installs. All three must agree — a
disagreement between them is a sharper bot signal than any single wrong UA.
Native-UA profiles opt out at every layer, including popup child windows and
after a browser-native cookie import.
Validated live against a real account: freshness cookies issued and rotating on
a ~10-min cadence, session still signed in and self-renewing past 10 hours,
against a pre-fix baseline of death at ~1h.
Closes#11518.
Brennan Benson
419151dddd