feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

README.md

@@ -249,7 +249,7 @@ These commands run on the **active tab**. The tab must be on a regular `http://`
 browser-cli dom query "h1"                   # return elements matching CSS selector
 browser-cli dom text "h1"                    # get text content of matching elements
 browser-cli dom attr "a" href                # get attribute value from elements
-browser-cli dom exists ".cookie-banner"      # exits 0 if found, 1 if not
+browser-cli dom exists ".modal-banner"       # exits 0 if found, 1 if not
 browser-cli dom click ".accept-button"       # click an element
 browser-cli dom type "#search" "hello"       # type text into an input
 ```
@@ -363,7 +363,7 @@ b.windows.close(1)
 elements = b.dom.query("h2")           # list of { tag, text, attrs }
 texts = b.dom.text(".article p")       # list of strings
 attrs = b.dom.attr("a", "href")        # list of strings
-exists = b.dom.exists(".cookie-banner")# bool
+exists = b.dom.exists(".modal-banner") # bool
 b.dom.click(".accept-button")
 b.dom.type("#search", "hello world")
 b.dom.wait_for("#results", visible=True, timeout=10)
@@ -376,11 +376,10 @@ text = b.extract.text()       # string
 data = b.extract.json("#app-data")  # parsed Python object
 md = b.extract.markdown("article")
 
-# Page / storage / cookies
+# Page / storage
 info = b.page.info()
 b.storage.set("token", "abc")
 val = b.storage.get("token")
-cookies = b.cookies.list(domain="example.com")
 
 # Sessions  ── b.session
 b.session.save("before-meeting")
@@ -489,6 +488,15 @@ npm run check:extension
 
 The extension source lives in `extension/src/`. `extension/background.js` and `extension/content-dispatch.js` are generated and ignored by git. Run `npm run build:extension` before using `Load unpacked` with `extension/`. On NixOS, use `nix-shell` first if npm is not installed globally.
 
+Packaging:
+
+```bash
+npm run package:extension           # local/unpacked zip, keeps manifest.key for stable native-messaging ID
+npm run package:extension:webstore  # Chrome Web Store zip, strips manifest.key
+```
+
+Chrome Web Store rejects `manifest.key`, so upload the `*-webstore-*` zip from `dist/`.
+
 ---
 
 ## Limitations