chore: prepare verified CRX uploads and release 0.15.4

- Add helper scripts for Chrome Web Store verified CRX uploads using a dedicated RSA upload key protected by GPG.
- Document the verified upload packaging flow and ignore local signing secrets.
- Add npm packaging entry point for signed webstore CRX artifacts.
- Chunk large SDK tab close batches to avoid native-host response timeouts.
- Bump project and extension versions to 0.15.4 with matching tests.

README.md

@@ -515,12 +515,21 @@ The extension source lives in `extension/src/`. `extension/background.js` and `e
 Packaging:
 
 ```bash
-npm run package:extension           # testing/unpacked zip, keeps manifest.key for stable Chromium native-messaging ID
-npm run package:extension:webstore  # Chrome Web Store zip, strips manifest.key
-npm run package:extension:firefox   # Firefox zip, strips manifest.key and Firefox-incompatible permissions
+npm run package:extension                    # testing/unpacked zip, keeps manifest.key for stable Chromium native-messaging ID
+npm run package:extension:webstore           # Chrome Web Store zip, strips manifest.key
+npm run package:extension:webstore:verified  # Chrome Web Store CRX signed for verified uploads
+npm run package:extension:firefox            # Firefox zip, strips manifest.key and Firefox-incompatible permissions
 ```
 
-Chrome Web Store rejects `manifest.key`, so upload the `*-webstore-*` zip from `dist/`. For Firefox, use the `*-firefox-*` zip.
+Chrome Web Store rejects `manifest.key`, so upload the `*-webstore-*` zip from `dist/`. For verified CRX uploads, create a dedicated RSA upload key once and protect it with your GPG key:
+
+```bash
+scripts/setup_verified_crx_key.sh --recipient '<your GPG key id or email>'
+# Add the generated public key in Chrome Developer Dashboard -> Package -> Verified uploads.
+npm run package:extension:webstore:verified
+```
+
+The verified-upload private key is not a GPG key; Chrome requires an RSA CRX signing key. GPG is used here to encrypt that RSA private key at rest. The signed `*.crx` from `dist/` is the upload artifact after verified uploads are enabled. For Firefox, use the `*-firefox-*` zip.
 
 For Firefox temporary testing via `about:debugging#/runtime/this-firefox`, run `npm run package:extension:firefox` first and load `dist/extension-package-firefox/manifest.json`. Do **not** load `extension/manifest.json` directly: it is the Chromium MV3 manifest and Firefox currently rejects `background.service_worker` for temporary add-ons.