feat: expose connection lifecycle and notification themes

[dvcolomban]

Background (Why)

Embedding hosts still duplicate browser subscriptions, connection recovery and notification presentation. These additions let a host enable, disable and reconnect browser control while keeping its existing shared transport.

Changes (What)

Add a connection-bound client with lazy principal-session readiness, subscription cleanup and obsolete-connection fencing. Panels can replace or remove their client, and page approval bindings follow availability.

Keep local exception causes on BrokerError and serialize only public BrowserControlErrorData. Preserve cleanup and structured unsubscribe failures during disposal.

Expose tool safety metadata, structured error normalization and correlated page-request handling. Extract the optional notification renderer’s default light/dark theme, retaining the headless controller and supporting theme updates without replacing focused or busy controls. The renderer uses constructed stylesheets and typed CSS properties; Chromium tests verify custom CSS precedence, theme changes and focus preservation. The standalone example keeps using the same public modules and accepts a host-selected identity directory.

Verification (Testing)

Affected package builds, lint and TypeScript checks pass. The 35 focused regression tests cover principal isolation, reconnect replacement, message lifecycle, headless operation, themes and error metadata. Four Chromium tests pass across native Devframe control, embedded/standalone notification hosts and the built theme renderer.

Full pnpm verify CI passes on 6e033da. The final manual diagnostics run still fails: snapshot p95 is 1,511 ms over WebSocket and 1,549 ms over Devframe; Devframe reference click p95 is 918 ms and locator click p95 is 1,938 ms. The timeout leaves 26/30 blocked locator samples. All 120 lifecycle cycles pass. Earlier failed measurements are retained below. The manual diagnostics run completed 30 cycles each of navigation, reconnect, cancellation and revocation. WebSocket snapshots still exceed the one-second p95 gate. Devframe exceeds action/snapshot gates and its ten-minute benchmark timed out with 28 of 30 blocked locator samples recorded. These failures and partial results remain in the run logs and summary.

Downstream validation remains incomplete pending verification of the reloaded extension, positive iframe repeat and live group-policy decision. This PR remains a draft until functional proof is complete. Performance and unreproduced intermittent stalls remain explicit follow-ups.

Screenshots

Optional CDB notification renderer, using synthetic requests with short and long client labels. Light/dark captures illustrate the default theme with host-configured Accept/Reject actions.

Light	Dark