Add WebMCP discovery and invocation API

[rgarcia]

Summary

• add GET /webmcp/tools and POST /webmcp/invoke so callers can discover and invoke native page tools without managing browser protocol events
• lazily reuse one browser-level connection and track every existing and newly opened tab, window, popup, and embedded frame
• separate the event-aware protocol transport, reusable browser-surface model, and WebMCP registry/invocation lifecycle
• return one flat tool snapshot with monotonic integer window, tab, and optional embedded-frame IDs while keeping raw protocol IDs internal
• invalidate stale registrations across committed navigation and closure, preserve completed responses during teardown, and report ambiguous outcomes without automatic retries
• validate invoke requests against the documented required fields, bounds, and unknown-property policy

Validation

• go vet ./...
• go test -race $(go list ./... | grep -v /e2e$)
• node --test runtime/*.test.ts
• navigation ordering tests under go test -race -count=50
• verified browser-wide discovery and invocation against live top-document, cross-origin iframe, and nested cross-origin iframe tools
• verified duplicate-name routing, popup survival after opener closure, dynamic registrations, stale refs, concurrent invokes, timeout behavior, and provenance
• verified unresolved navigation returns outcome_unknown, completed-before-navigation results survive, and aborted navigation preserves the original registration
• verified malformed invoke requests return schema-compatible JSON errors

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ac251e6. Configure here.}