test: verify Tampermonkey release contract

[jackhai9]

Summary

• add a strict userscript release manifest with version, metadata, SHA-256, and size
• parse Tampermonkey MCP read-back transport metadata without weakening source equality
• document the connected-Chrome injection and reversible L3 acceptance contract

Validation

• npm test (303/303)
• npm run test:ui (45/45)
• npm run check:binance-orderbook-trade
• node --check scripts/userscript-release-contract.mjs
• git diff --check
• Tampermonkey MCP patch/read-back exact source match for 2.7.119
• raw CDP scriptParsed before DOMContentLoaded; loaded source contains exact generated artifact
• live panel collapse/expand restored exactly

Scope

Test and release tooling only; no production userscript behavior or version change.