`importCookies` forwarded the IPC-supplied `sourceProfileDirectory` straight
into the cookie database path, so `..` segments walked out of the browser's
user-data directory and imported any cookie database reachable on disk. It is
now only honoured when the source itself reported it.

The running-browser check used `access` on Chromium's `SingletonLock`, which is
a symlink to a `<host>-<pid>` target that never exists. Following it reported
every running browser as closed, so an import could read a live, mid-write
database — Helium open on this machine was detected as closed. It now stats the
link itself.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>