Add trusted-local Autopilot policy profiles

[wolfiesch]

Why

AgentTab is primarily used for unattended local automation, but the current Commit flow and runtime scripting permission request can leave work waiting on a popup the user never sees. This bundle makes the trusted-local policy explicit and persistent while retaining a human boundary for secrets.

What changes

• Adds extension-local Autopilot, Review selected, and Strict profiles.
• Starts genuinely fresh extension state in Autopilot; any existing/pre-policy state migrates to Strict with no remembered allowances.
• Supports remembered approvals scoped to a task, an HTTP(S) origin, or all sites.
• Keeps passwords, passkeys, OTPs, CAPTCHA, payment-card secrets, and similar sensitive fields behind Your Turn in every profile.
• Makes scripting an install-time permission so unattended actions do not stop at a runtime grant prompt.
• Separates action policy from Native Messaging v1; there is no host/protocol lockstep deployment requirement.
• Adds agenttab policy allow-upload PATH for the existing host upload-root policy, with atomic cross-process merging, bounded locking, idempotency, and accurate restart reporting.
• Clarifies that Pause is an admission toggle, not a permission revocation.

Review decisions

• Fresh-install default: Autopilot deliberately favors completion over review prompts and can execute recognized irreversible/high-cost actions.
• Upgrade behavior: existing installs stay effectively Strict, avoiding a silent broadening during update.
• Chrome permission update: moving scripting from optional to required may cause a one-time Chrome permission disclosure or extension disable depending on Chrome/update policy.
• Remembered scope: “all sites” is intentionally broad and persistent until cleared.
• Classifier limits: semantic effect classification is best effort; a page can disguise an effect or attach unexpected handlers.

Validation

• Workspace TypeScript typecheck and builds
• Extension typecheck/build and 102 tests
• Installer typecheck/build plus concurrent multi-process upload-policy regressions
• Permission/identity/forbidden-surface gates
• 13 protocol schemas and 23 fixtures
• Confirmed zero native-v1 wire diff for action profiles

Why draft

This directly encodes the project’s trusted-local, low-interruption philosophy, but the default, permission migration, and persistent allowance scopes are product-policy choices that should be explicitly approved.