Add unit tests for sender.ts routing and retry logic

[grahamlangford]

source/sender.ts is the largest module in the library (470 lines) and had no unit tests. CI's Test job runs vitest run, which excludes source/test/ — those are browser-driven demo tests that need a built extension. The entire CI unit suite was therefore one file, targetLogic.test.ts, covering only getActionForMessage.

Gap identified

Every decision messenger() makes — which browser API to call, what the envelope looks like, whether an error is retryable, when to stop — was covered only by the demo extension, which CI does not run. A change to sender.ts could pass all four CI jobs while breaking messaging. This is also the file where both recent behavioral changes landed.

Bugs this would have caught

• 0.35.0 regression: local-handling short-circuit breaks messaging in about:srcdoc content scripts #409 (Handle messages locally in content script as well #363, reverted in Revert "Handle messages locally in content script as well" #410). 0.35.0 hoisted a compareTargets() short-circuit onto the send path. In a sandboxed about:srcdoc frame location.origin is the string "null", so new URL(page, location.origin) threw and every outbound message from that frame failed, starting with storeTabData()'s __getTabData call. It shipped, broke srcdoc iframes downstream (pixiebrix/pixiebrix-source#8368), and was reverted eight months later.

  I verified the pin rather than assuming it: re-applying Handle messages locally in content script as well #363 on top of this branch fails reaches the runtime from an opaque-origin frame with TypeError: Invalid URL — the exact production symptom. Re-applying Handle messages locally in content script as well #363 fails 20 of the 32 new tests overall.

• Drop p-retry; fix retry bugs #362 (Drop p-retry; fix retry bugs) rewrote the retry loop by hand — backoff, the safety cap, tab-liveness checks, the failed-attempt / attempts-exhausted events — with nothing covering any of it.

What the tests verify

• Routing — external extensions via sendMessage(extensionId, …); the background page invoking its own handler instead of messaging itself; extension pages via a single-argument sendMessage; tab targets falling back to the runtime where the tabs API is absent; frameId defaulting to 0, honouring an explicit frame, and dropping out to reach allFrames; the __webextMessenger marker and an increasing seq.
• Content-script sends (0.35.0 regression: local-handling short-circuit breaks messaging in about:srcdoc content scripts #409 regression) — an opaque-origin frame reaches the runtime instead of throwing, and a {tabId} target is never handled locally by the sending frame.
• Responses — values unwrapped, errors deserialized and rethrown without retrying, and the three distinct "nobody answered" errors (missing page target, messenger-less tab, third-party listener conflict).
• Retry — retries a missing receiver and a MessengerError from a still-booting target; a single attempt when retry: false; no retry after the target closed early, for a missing external extension, or once the context is invalidated; stops when the tab is gone or discarded; exponential backoff; attempts-exhausted fires, and the 15-attempt safety cap is never the reason it stopped.
• Notifications and helpers — notifications return undefined, send once, and swallow errors; getMethod with a fixed, promised, or caller-supplied target; getNotifier returns void and never rejects.

Test-only — no production file is touched. 48 tests pass in ~350ms; tsc, eslint, and prettier are clean.

One thing worth a separate look

tsc emits test files into distribution/, and .npmignore ships top-level distribution/*, so targetLogic.test.js is already published to npm today. This PR adds a second one (sender.test.js). Pre-existing and out of scope here, but a tsconfig exclude would drop both from the package.