feat: background Chrome workspace with relaxed approvals

[alexanderradahl]

Summary

Adds a first-class background browser path for Mac Developer Bridge so ChatGPT can operate the user's existing signed-in Chrome profile without routinely stealing focus.

Background Chrome

• adds the MV3 Mac Developer Bridge Background Browser extension and native-messaging host
• binds the host to the configured signed-in Chrome profile/account and fails closed on profile mismatch/sign-out
• adds a Chrome-native MDB tab group with a reusable background-tab pool
• chrome_open leases an existing MDB tab instead of creating a new tab during routine work
• the group collapses when idle, reconciles after service-worker restarts, and can rediscover its existing workspace
• waits for navigations to commit before handing a workspace tab back to the MCP
• adds the approved cat/headphones/laptop extension icon

Approval UX

• changes the default to Relaxed approvals: normal HTTP/HTTPS browser work and necessary native-app GUI execution do not require per-site/per-app Terminal approval commands
• adds a live Strict approvals checkbox to the menu-bar app, off by default
• Strict mode restores scoped background-Chrome URL grants and one-use foreground-app approvals
• strict browser grants are additive/shared across concurrent ChatGPT sessions and persist across bridge-child restarts until their individual expiry
• profile binding and the background MDB routing remain enforced regardless of approval mode

Focus behavior

• prefers the MDB browser/API path for normal browser/service automation
• adds background-first detection for desktop GUI automation
• in Strict mode, foreground GUI actions require an app-scoped one-use approval
• fixes the prior model-controlled env-var bypass

Operational/safety work

• extends disable.sh to reclaim the Chrome native host and revoke pending/shared browser/foreground approvals
• fixes federation test isolation so disable.sh tests cannot kill the developer's live bridge checkout
• documents the exact authority model and the fact that Strict approvals is an operator UX/drift control, not a sandbox

Validation

• npm test — all smoke, integration, adversarial, HTTP, OAuth, PTY, federation, background-Chrome, and installer tests pass
• npm run check
• npm pack --dry-run --json — required extension/native-host files included
• git diff --check
• swiftc -typecheck -target "$(uname -m)-apple-macos13.0" -framework AppKit menubar/MenuBarApp.swift
• live macOS acceptance: the signed-in Chrome profile stayed in the background while MDB used/released the managed tab group; Chrome extension v0.2.2 connected successfully
• live status after restart reports operatorSettings.strictApprovals: false and browser accessMode: relaxed

Notes

The package version is intentionally unchanged in this PR; release/versioning can happen separately after review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.