feat: Shadow DOM Piercing — Recursive traversal of shadowRoot boundaries

[Delqhi]

Problem

Modern web apps (Prolific, Salesforce, React) use Shadow DOM and Web Components. Our accessibility tree snapshot only scans the light DOM, missing elements hidden behind shadowRoot boundaries. This causes "hit-and-miss" failures.

Evidence

• Shadow DOM hides component internals from document.querySelectorAll()
• closed shadow roots require CDP or MAIN world injection
• Content scripts in ISOLATED world cannot pierce shadow boundaries natively
• Chrome MV3 requires chrome.scripting.executeScript with world: 'MAIN' for full access

Solution (Implemented)

1. injector.js: Added recursive shadowRoot traversal in the tree walker:

   if (child.shadowRoot) {
       let shadowNodes = Array.from(child.shadowRoot.querySelectorAll('*'));
       shadowNodes.forEach(child => walk(child, depth + 1));
   }

2. injector.js: Added window._sinDeepQuery(selector) utility that pierces all shadow boundaries recursively

Files Changed

• extension/content/injector.js — tree walker + _sinDeepQuery utility

Acceptance Criteria

• Accessibility tree includes elements inside shadow roots
• _sinDeepQuery finds elements across shadow boundaries
• Prolific React components are fully visible in snapshots

[Delqhi]

Implementation note from cloud execution lane:

• A clean worktree was used for issue-scoped implementation to avoid contaminating the dirty local checkout.
• Reported outcome: injector traversal was unified so snapshot/query flows recurse through open shadow roots and include same-origin iframe discovery.
• Reported validation: targeted injector tests passed in the clean worktree lane.
• Important repo-state note: unrelated local modifications in the default checkout still require PR isolation/staging hygiene before merge.