feat!: harden raw browser control and packaging

- Add safe-by-default policy gates for raw command surfaces: command, script, and serve-http /command.

- Require explicit opt-ins for page reads, browser control, and high-risk commands such as dom.eval, storage.*, and screenshots.

- Remove all cookies support from CLI, SDK, extension commands, permissions, constants, docs, and tests.

- Add diagnostic, events, watch, workspace, remote, raw command, script, HTTP gateway, tree-view, session import/export, and extension info/capability commands.

- Add Chrome Web Store packaging that strips manifest.key while keeping local packages with a stable native-messaging extension ID.

- Bump browser-cli and extension version to 0.14.1 and cover the new behavior with pytest and extension packaging tests.

BREAKING CHANGE: cookies commands and the b.cookies SDK namespace have been removed; generic raw command execution now blocks non-safe commands unless explicitly allowed.

tests/test_extension_packaging.py

@@ -0,0 +1,35 @@
+import importlib.util
+import json
+import zipfile
+from pathlib import Path
+
+def _load_packager():
+    path = Path(__file__).resolve().parents[1] / "scripts" / "package_extension.py"
+    spec = importlib.util.spec_from_file_location("package_extension", path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec.loader is not None
+    spec.loader.exec_module(module)
+    return module
+
+def test_webstore_package_strips_manifest_key(tmp_path):
+    packager = _load_packager()
+    out = packager.package_extension(webstore=True, out=tmp_path / "webstore.zip")
+
+    with zipfile.ZipFile(out) as zf:
+        manifest = json.loads(zf.read("manifest.json"))
+        names = set(zf.namelist())
+
+    assert "key" not in manifest
+    assert "background.js" in names
+    assert "content-dispatch.js" in names
+    assert "content.js" in names
+    assert "icons/icon-128.png" in names
+
+def test_local_package_keeps_manifest_key(tmp_path):
+    packager = _load_packager()
+    out = packager.package_extension(webstore=False, out=tmp_path / "local.zip")
+
+    with zipfile.ZipFile(out) as zf:
+        manifest = json.loads(zf.read("manifest.json"))
+
+    assert "key" in manifest