cut unit test runtime

The Tests job is 18m55s and integration is gated on it, so it caps the critical path once integration drops.

Locally the suite is 515s across 126 packages. The top 6 are 70% of it:

package	time
protocols/headless/engine	193.7s
installer	56.5s
input/formats/openapi	35.5s
input/formats/swagger	35.5s
protocols/http	20.2s
lib/tests	19.3s

-race is not the multiplier: ubuntu with race is 18m55s, windows without it 17m45s.

Three concrete causes:

headless/engine, 193.7s. 33 call sites of testHeadless (page_actions_test.go:979), each doing New(...) + defer browser.Close(), so every test launches and tears down its own Chromium. Nothing is shared and there is no t.Parallel() in the file. browser.NewInstance() is already the isolation boundary, so a package-level browser shared across tests keeps coverage. Separately, headless_local is never set in CI, so rod manages its own binary and re-validates (and on failure re-downloads) per launch, which is the likely cause of this package measuring 193s in one run and 1281s in another.

installer, 56.5s. TestTemplateInstallation is 34.4s of it and calls FreshInstallIfNotExists(), downloading the real nuclei-templates from GitHub. It already handles a rate-limit error by skipping, which shows the network dependency is known.

openapi + swagger, 70s combined. TestOpenAPIDownloader_Download_Timeout and TestSwaggerDownloader_Download_Timeout are 35.00s each, sleeping past a hardcoded http.Client{Timeout: 30 * time.Second} (openapi/downloader.go:42). The downloader already accepts an injected client, so the test can pass a short-timeout one instead.

Part of #7803.