geolocation:latitude/longitude auto-grant never applies on 152.0.4-beta.30 — permission stays prompt, getCurrentPosition hangs, page timers freeze

Build: camoufox 152.0.4-beta.30 (official fetched binary, macOS arm64) Launch mode: headless over the Juggler automation pipe; config delivered through the CAMOU_CONFIG chunked env vars; test page served from http://127.0.0.1:<port>/ (a secure context, so navigator.geolocation is exposed).

Expected (per the docs at camoufox.com/fingerprint/geolocation):

Location permission prompts will be accepted automatically if geolocation:latitude and geolocation:longitude are set.

Observed with geolocation:latitude=52.52, geolocation:longitude=13.405 (plus the variants enumerated below):

• navigator.permissions.query({name:'geolocation'}) stays state: "prompt";
• getCurrentPosition() never resolves — neither the success nor the error callback fires;
• while the prompt is pending, the page's timers are frozen: a 7 s setTimeout watchdog never runs until the probe gives up;
• child stderr shows the permission prompt itself failing to open under automation: chrome://juggler/content/TargetRegistry.js, line 637: TypeError: can't access property "getContentDialogManager", this._linkedBrowser.tabDialogBox is undefined.

Other CAMOU_CONFIG keys ARE honored in the very same launches (webrtc:ipv4 appears as the srflx candidate, mediaDevices:micros/webcams counts spoof, voices list injects), so config delivery and the MaskConfig plumbing are live — only the geolocation auto-grant never fires.

Surfaces tried — every one leaves permState=prompt with the unresolved call:

#	Surface	Observed
1	geolocation:latitude + geolocation:longitude	prompt pending, timers frozen
2	#1 + geolocation:accuracy=25	same
3	#1 + pref permissions.default.geo=1, written as a user.js user pref in the profile dir (the stock CheckPromptPrefs path)	same
4	explicit per-site grant via nsIPermissionManager from the automation realm	not reachable — the Juggler evaluation realm exposes no Components/XPConnect
5	permissions.sqlite pre-seeded with a geo allow row (moz_perms: origin='http://127.0.0.1:<port>', type='geo', permission=1, expireType=0, expireTime=0; schema and user_version=13 captured from a fresh launch of this build, never assumed)	the row persists in the DB after the session, but the page still reads prompt and getCurrentPosition still hangs
6	#1–#3 combined + geo.provider.testing.url / geo.provider.network.url pointing at a fixed position document	same

Where this looks like it lives: the auto-grant in patches/geolocation-spoofing.patch sits in Geolocation::RegisterRequestWithPrompt ahead of CheckPromptPrefs, gated on the MaskConfig lat+lon lookup. On this build the request always falls through to the prompt path (which then cannot even open under Juggler). Related older issue: #291 (different class — real geo after accepting the prompt — but the same surface).

Full diagnostic launch logs (one line per attempt above, plus child stderr tails) available on request.