feat(adopt): read a pre-existing tab without opening a new one

New `chrome-use adopt <url-substring|targetId>`: drive a tab the user (or
another session) already has open, with ZERO new tabs. After group-scoped
isolation (#40) a session can't see foreign tabs, so adopt adds an explicit,
opt-in path:

- Relay (relay.rs): `ABRelay.getAllTargets` returns every attached target
  UNSCOPED (ignores group scoping), so the agent can find a specific tab by URL
  or targetId. +1 unit test.
- Daemon (browser.rs): `collect_all_targets` (unscoped, falls back to scoped on
  older relays) + `adopt_existing_target` — matches by exact targetId or
  case-insensitive URL substring, attaches it (the relay re-tags it into the
  adopter's group, so isolation holds), pins it; never creates a tab. On no
  match it errors AND lists the open tabs it can see, rather than launching.
  discover_and_attach_targets honors AGENT_BROWSER_ADOPT at first connect, so no
  about:blank is ever created.
- CLI (main.rs): `adopt` sets the env, forces a fresh daemon, and rewrites into
  `connect <relay-url>` (like `extension connect`) so the daemon attaches to the
  user's real Chrome before parse_command.

Extension (ab-connect 0.4.11): `reannounceAttachedTabs` now re-sends each tab's
url/title (it previously sent neither) so the relay's target list stays matchable
by URL after the MV3 service worker reconnects — otherwise reannounced tabs show
a blank url and `adopt <url>` can't find them. Repacked upload zip + crx.

Mechanism verified live (enumerated all 11 of the user's open tabs incl. the
target). 862 tests pass.

extensions/ab-connect/background.js

@@ -471,8 +471,19 @@ async function reannounceAttachedTabs() {
   for (const [tabId, entry] of tabs.entries()) {
     // Re-send the group hint too (issue #40) so the relay can rebuild its
     // targetId→group map after its own restart (createTarget tagging won't
-    // re-run for tabs that are already open).
+    // re-run for tabs that are already open). Include the live url/title so the
+    // relay's target list stays matchable by URL after a reconnect (otherwise a
+    // reannounced tab shows a blank url and `adopt <url>` can't find it).
     const { openerTargetId, abGroup } = await tabScopeHints(tabId)
+    let url = ''
+    let title = ''
+    try {
+      const t = await chrome.tabs.get(tabId)
+      if (t) {
+        url = t.url || t.pendingUrl || ''
+        title = t.title || ''
+      }
+    } catch {}
     postToHost({
       method: 'forwardCDPEvent',
       params: {
@@ -480,7 +491,7 @@ async function reannounceAttachedTabs() {
         method: 'Target.attachedToTarget',
         params: {
           sessionId: entry.sessionId,
-          targetInfo: { targetId: entry.targetId, type: 'page', attached: true, openerTargetId, abGroup },
+          targetInfo: { targetId: entry.targetId, type: 'page', url, title, attached: true, openerTargetId, abGroup },
         },
       },
     })