Harden startup discovery and add CI smoke coverage

[justrach]

Summary

• resolve and validate the CDP endpoint before serving traffic
• auto-discover tabs during startup so first-run /tabs is populated
• add regression coverage for discovery and startup parsing
• add a GitHub Actions startup smoke job with real Chrome

Verification

• zig build test
• zig build
• manual managed startup smoke (/health, /tabs, /discover)
• manual external CDP_URL=http://127.0.0.1:9224/json/version startup smoke
• invalid external CDP URL fails before binding the server

[justrach]

Review

The CI smoke test and startup auto-discovery are still valuable. However, much of the client/router/bridge work in this PR now overlaps with main.

✅ Still useful — keep these parts

• .github/workflows/ci.yml — CI smoke job with real Chrome is great for catching startup regressions
• Startup auto-discovery — populating /tabs on first boot so the first API call doesn't need a manual /discover
• Regression tests for discovery and startup parsing

❌ Already on main — drop these parts

• client.zig changes (EventBuffer is completely different now)
• bridge.zig key ownership (allocator.dupe already merged)
• router.zig discovery/evaluate changes (already merged)
• har.zig ownership changes (already merged)

🔧 Recommendation

This PR touches 17 files but only ~3 are still needed. I'd recommend:

1. Close this PR
2. Open a fresh PR with just the CI workflow + startup auto-discover changes
3. Skip the client/router/bridge/har changes that are already on main

That avoids a painful 17-file rebase where most hunks conflict.

[justrach]

Can you update this PR to build and test against Zig 0.16.0? The active release/CI path is now targeting 0.16.0, so it would help to rebase and rerun on that toolchain before review.

[justrach]

This branch is 58 days old and most of its scope looks like it's been overtaken by:

• 1cb5bf7 fix(ci,skills): help/version regression guard
• 3bbd403 feat(server,chrome): bearer-token API auth + signal-safe Chrome lifecycle
• dac5672 ci: teach startup-smoke about the new bearer-token wall

Quick diff to check whether any of the discovery-hardening here is missing on main:

git diff main...fix/startup-onboarding-smoke -- src/server/ src/chrome/ .github/workflows/

If the answer is "nothing material is missing," close as superseded.