Converge multiremote launcher/worker wiring into native-core

Follow-up from #635 (electrobun Linux parallel + multiremote). Reviewing multiremote across electron / tauri / dioxus / electrobun surfaced wiring that each service re-derives by hand — and electrobun got a subtle piece wrong (per-instance connection params on the inner caps instead of the outer wrapper → Linux/W3C multiremote didn't route; fixed in #635). The correct behavior should be the default a new W3C service inherits, not something it re-discovers. Relevant as RN + Flutter still owe multiremote (#446) and Capacitor/Neutralino are on the roadmap.

Principle: unify the contract + correctness-critical wiring; leave the per-framework mechanism alone.

Core deliverable — extract into native-core

• Connection-param placement helper. normaliseInstanceCaps(capabilities) → { caps, connectionTarget }[]. WDIO reads per-instance hostname/port from the outer { capabilities } wrapper for multiremote, but hoists them out of the caps object for single-session (@wdio/runner initializeInstance + sanitizeCaps). Encapsulate that so no service writes to the wrong place again. (Applies to the pre-spawned-W3C-server class: tauri external/embedded, dioxus embedded, electrobun-WebKitGTK — not the CDP-attach class, which puts debuggerAddress/--inspect inside caps and lets WDIO own the port.)
• Worker-side instance iteration helper. forEachInstance(browser, (instance, caps) => …) wrapping the isMultiremote → loop instances → per-instance caps resolution (electron's alwaysMatch unwrap, electrobun's capabilityFor). Boilerplate replicated 4×; electrobun's attachInstance/capabilityFor is the cleanest model to lift.

Related convergence (checklist)

• Per-instance port allocation — standardize on PortManager/get-port. base+i (dioxus-embedded, tauri-embedded) risks cross-worker collisions (cf. the ghost-port / hardcoded-4444 history); audit those paths before switching.
• Teardown hygiene — always remove per-instance temp resources on teardown. Electrobun rms its bundle clones; tauri leaves generateDataDirectory temp dirs to the OS. (Independently grabbable — small standalone tauri cleanup.)
• Multiremote-safety guard — shared warn/error helper driven by a per-service isolatesInstances(platform) descriptor; keep the per-service policy local. Today: electron none, tauri perWorkerMode, dioxus none, electrobun macOS-CEF warn.

Explicitly OUT of scope (legitimate, framework-dictated — do not unify)

• Isolation mechanism: bundle clone (electrobun, path-scoped reap) vs XDG_DATA_HOME/TAURI_DATA_DIR (tauri) vs process+port only (dioxus/electron).
• Driver model: WDIO-managed chromedriver (CDP) vs launcher-pre-spawned W3C server.
• Setup hook: onPrepare (electron/tauri/dioxus) vs onWorkerStart (electrobun, dynamic per-worker ports) — both correct; just document the choice in the add-native-service runbook so it isn't copied by accident.

Definition of done

Helpers for the two core items live in native-core and are adopted by the pre-spawned-server services; add-native-service references them. Checklist items can land incrementally.

Refs: #635, #633, #446

Start by comparing electrobun's attachInstance/capabilityFor pattern with WDIO's initializeInstance and sanitizeCaps behavior, then inspect the pre-spawned-server services using the repeated multiremote wiring. Define the two helpers in native-core and adopt them in the applicable services, while checking port allocation and teardown paths. Done means the helpers are used by those services and the add-native-service runbook documents the setup-hook choice.