Mark concrete classes that have no subclasses as final. Covers the ten challenge_bypass_ristretto value wrappers, the network layer (HttpClient, ObliviousHttpClientImpl, ObliviousHttpKeyConfig), the ad serving round-robin, the scoped test timezone helper, and three browser-layer delegate implementations. No behavioral changes.