feat: add browser automation settings and fix confirmation waits

[iuyo5678]

Users can change the extension's Automation settings, but command-line overrides previously took precedence over those visible choices. This change makes the saved browser settings authoritative and fixes the shorter daemon timeout that caused repeated tab-borrow prompts.

The popup provides two independent switches, both enabled by default. With both on, borrowing requires approval and request-help uses the existing UI. Changes apply to existing and new sessions. Re-enabling a setting affects subsequent operations without undoing completed borrows or reopening finished help requests. Descriptions stay in info tooltips, and option labels use smaller, regular-weight text.

The current CLI accepts --unattended, tab borrow --no-confirm, and BSK_REQUEST_HELP=off for compatibility but reports them as deprecated. It does not use them to override browser settings. The current daemon ignores its inherited help override and strips legacy borrow overrides before forwarding, including when connected to an older extension. Help requests reaching the current daemon go to the owning extension. Missing confirmation wiring returns an error instead of granting approval.

Protocol 1.3 keeps the base handshake floor at 1.0, allowing staggered CLI and extension upgrades. Ordinary sessions and default tab borrowing remain available with compatible older peers. The popup explains older-daemon limitations and clears that guidance after an update; saved switch values are preserved. Protocol major mismatches and peer-declared incompatible floors are still rejected.

Feature requirements are limited to the affected operations:

• The current CLI's request-help requires daemon protocol 1.3 because older daemons may return locally without consulting the browser. Other operations remain available.
• A custom borrowing wait requires daemon and extension protocol 1.2 or later. Unsupported errors identify the component to update; default borrowing remains available.
• Full setting precedence requires an updated CLI, running daemon, and extension. New extensions always enforce their saved settings on requests they receive. Old executables may still end help locally before connecting, and old daemons may retain shorter borrowing budgets.

The original timeout fixes remain: current daemon and CLI budgets cover the 60-second confirmation UI plus cleanup grace. Deadlines dismiss pending UI; completed borrows are idempotent; pending duplicates, user denial, timeout, unavailable UI, and uncertain move outcomes remain distinct. Changing --timeout never changes whether approval is required.

Preference-read failures retain known values or default to both settings enabled, without persisting fallback defaults or blocking session creation. Later reads and storage events recover saved values; popup reads and writes remain strict. When help is disabled, the skill directs the agent to re-observe and continue authorized work within available capabilities. Disabled does not mean completed or grant permission. CLI and DSH skills preserve user-tab isolation and host rules.

Validation:

• Rust workspace: 672 passed locally with one test thread. Real CLI/daemon subprocess tests cover all four browser policies, both process environments, legacy flags, and mixed extension protocols 1.0–1.3. IPC tests cover older daemons, operation-specific errors, and continued session use after those errors.
• Retained protocol 1.2 binaries were exercised in both directions: current CLI with the older daemon, and older CLI with the current daemon. Handshakes and browser replies used a WebSocket test peer. Sessions, default borrowing, and teardown passed; the older CLI retained its local disabled-help behavior.
• Extension: 1,317 passed, 40 existing skipped; TypeScript and production ZIP build passed. Tests verify that compatible older handshakes do not disconnect or clean up sessions, and that popup compatibility guidance disappears after an update.
• DSH: 232 passed and typecheck passed after regenerating CSS and bundled skill content. The skill body is 5,973 characters, within the existing 6,000-character limit. Localization: 52 passed. All three skill validations passed.
• Biome, Stylelint, Rust formatting, schema generation, and Clippy with warnings denied passed. Windows CI includes the mixed-version subprocess tests in the existing interaction regression suite.
• Browser behavior is covered with mocked Chrome APIs and real IPC/WebSocket/process tests; this does not claim a loaded-extension or live model verification-solving test.

Final commit: 0170852. All four CI jobs and the repository open-source scan passed.