feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

browser_cli/commands/raw.py

@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+import json
+
+import click
+
+from browser_cli.command_security import CommandPolicy, assert_command_allowed
+from browser_cli.commands import client_from_ctx, handle_errors
+
+@click.command("command")
+@click.argument("name")
+@click.argument("args_json", required=False, default="{}")
+@click.option("--allow-read-page", is_flag=True, help="Allow page-content read commands such as extract.* and dom.text")
+@click.option("--allow-control", is_flag=True, help="Allow browser-control commands such as nav.*, tabs.close, dom.click")
+@click.option("--allow-dangerous", is_flag=True, help="Allow high-risk commands such as dom.eval, storage.*, screenshots")
+@handle_errors
+def cmd_command(name, args_json, allow_read_page, allow_control, allow_dangerous):
+    """Send a raw browser-cli wire command and print JSON."""
+    policy = CommandPolicy(allow_read_page=allow_read_page, allow_control=allow_control, allow_dangerous=allow_dangerous)
+    assert_command_allowed(name, policy)
+    args = json.loads(args_json) if args_json else {}
+    result = client_from_ctx().command(name, args)
+    click.echo(json.dumps(result, indent=2, default=str))