feat(browser-control): add Chrome debugging bridge

[dvcolomban]

Background (Why)

Browser agents need a secure, explicit bridge to Chrome targets without exposing privileged debugging capabilities through page WebMCP. This change completes the broker, extension, MCP, Devframe, and consumer-facing contracts required for authenticated browser control and prepares the package graph for a coherent 0.3.0 release.

Changes (What)

• Add authenticated provider, target, grant, lease, and request lifecycles across the CDB package graph.
• Add native WebMCP discovery and invocation behind CDB authorization boundaries.
• Add the Browser Control Devframe panel, approval notifications, responsive management views, and Devframe 1.0 page integration.
• Upgrade Devframe and related tooling to released versions, removing temporary package patches and backport tests.
• Harden package boundaries and the npm publish workflow, including building distributable output before Publint and trusted publishing.

Verification (Testing)

The complete release simulation passed all 39 Turbo verification tasks, including 35 browser E2E tests with 2 benchmark cases intentionally skipped. Build, package tests, root/package typecheck, lint, package boundaries, Publint, Knip, catalogue generation, and focused Devframe notification scenarios pass. A reversible 0.3.0 bump produced all eight tarballs with resolved ^0.3.0 internal ranges, expected distributable files, and no workspace, catalog, file, or link dependency leaks. All eight npm names currently publish 0.2.0, and 0.3.0 is available.