feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

browser_cli/sdk/browser_data.py

@@ -1,4 +1,4 @@
-"""Storage and cookies namespaces: ``b.storage.*``, ``b.cookies.*``."""
+"""Storage namespace: ``b.storage.*``."""
 from __future__ import annotations
 
 from browser_cli.sdk.base import Namespace, sdk_command
@@ -35,51 +35,3 @@ class StorageNS(Namespace):
     tab_id: int | None = None,
   ) -> None:
     """Set a localStorage/sessionStorage entry."""
-
-class CookiesNS(Namespace):
-  """List, get, and set cookies."""
-
-  @sdk_command("cookies.list", lambda self, *, url=None, domain=None, name=None: {
-    "url": url,
-    "domain": domain,
-    "name": name,
-  }, default=[])
-  def list(
-    self,
-    *,
-    url: str | None = None,
-    domain: str | None = None,
-    name: str | None = None,
-  ) -> list[dict]:
-    """List cookies, optionally filtered by url, domain, or name."""
-
-  @sdk_command("cookies.get", lambda self, url, name: {"url": url, "name": name})
-  def get(self, url: str, name: str) -> dict | None:
-    """Get a single cookie by url and name."""
-
-  @sdk_command("cookies.set", lambda self, url, name, value, *, domain=None, path=None, secure=None,
-         http_only=None, expiration_date=None, same_site=None: {
-    "url": url,
-    "name": name,
-    "value": value,
-    "domain": domain,
-    "path": path,
-    "secure": secure,
-    "httpOnly": http_only,
-    "expirationDate": expiration_date,
-    "sameSite": same_site,
-  })
-  def set(
-    self,
-    url: str,
-    name: str,
-    value: str,
-    *,
-    domain: str | None = None,
-    path: str | None = None,
-    secure: bool | None = None,
-    http_only: bool | None = None,
-    expiration_date: float | None = None,
-    same_site: str | None = None,
-  ) -> dict:
-    """Set a cookie. Returns the created cookie dict."""