feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

.gitea/workflows/package-extension.yml

@@ -39,14 +39,10 @@ jobs:
           )"
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
-      - name: Build extension archive
+      - name: Build extension archives
         run: |
-          rm -rf extension-package
-          mkdir -p dist extension-package
-          cp extension/manifest.json extension/background.js extension/content.js extension/icon.svg extension-package/
-          cp -R extension/icons extension-package/icons
-          cd extension-package
-          zip -r "../dist/browser-cli-extension-v${{ steps.version.outputs.version }}.zip" .
+          python scripts/package_extension.py --out "dist/browser-cli-extension-v${{ steps.version.outputs.version }}.zip"
+          python scripts/package_extension.py --webstore --out "dist/browser-cli-extension-webstore-v${{ steps.version.outputs.version }}.zip"
 
       - name: Publish extension release asset
         env: