Because:
- Ahead of passwordless Sync (Phase 2) we need the true PRF capability of
the passkey base; the registration-time prfEnabled flag under-reports it.
This commit:
- Requests the WebAuthn PRF extension at passkey sign-in behind a new
scope-aware, default-off flag (PASSKEYS__REQUEST_PRF_AT_AUTHENTICATION).
- Detects PRF support client-side, strips the output so it never reaches
the server, and sends only a boolean on authentication/finish.
- Rolls prfEnabled forward false->true (monotonic, best-effort) inside the
verified finish flow; never blocks sign-in.
- Adds Glean + StatsD telemetry to back the kill switch.