feat(connect): native-messaging transport — zero-token connect to real Chrome

Optimal architecture (chosen over the WS+token copy): the ab-connect extension
talks to a local agent-browser native-messaging host. No localhost port, no
token — Chrome authenticates the extension to the host by id. This is the
codex/claude-style "install once, no per-use confirmation" model.

- extensions/ab-connect: rewritten transport WebSocket+token → native messaging
  (chrome.runtime.connectNative). Pinned the extension id via a manifest `key`
  (→ bdoiejojpjogcjojeladhioioijhgade) so the host manifest can authorize it.
  Kept the proven chrome.debugger attach + Target.attachedToTarget emulation;
  dropped WS/token/options. Rebranded to "agent-browser connect".
- cli connect.rs: `agent-browser extension install` writes the native-messaging
  host manifest (Chrome/Chromium/Edge/Brave) + a launcher; hidden `__nm-host`
  speaks the 4-byte-length native-messaging framing.

Validated end-to-end on real Chrome: Chrome spawned the host (origin matched the
pinned id) and the extension attached the user's real logged-in tabs, streaming
Target.attachedToTarget over native messaging — zero token, zero port.

Next: bridge the host to the daemon relay (relay.rs) + CdpClient so
`agent-browser click/eval/...` drives those tabs.

cli/src/main.rs

@@ -2,6 +2,7 @@ mod chat;
 mod color;
 mod commands;
 mod connection;
+mod connect;
 mod doctor;
 mod findurl;
 mod flags;
@@ -503,6 +504,14 @@ fn main() {
         env::set_var("MSYS2_ARG_CONV_EXCL", "*");
     }
 
+    // Native-messaging host mode: Chrome launches `agent-browser __nm-host
+    // <extension-origin> [...]` for the ab-connect extension. Must run before
+    // ANY stdout write — stdout is the Chrome native-messaging channel.
+    if env::args().nth(1).as_deref() == Some("__nm-host") {
+        connect::run_nm_host();
+        return;
+    }
+
     // Native daemon mode: when AGENT_BROWSER_DAEMON is set, run as the daemon process
     if env::var("AGENT_BROWSER_DAEMON").is_ok() {
         // Ignore SIGPIPE so the daemon isn't killed when the parent drops
@@ -641,6 +650,13 @@ fn main() {
         return;
     }
 
+    // Handle extension (doesn't need daemon): native-messaging host install/status
+    // for the ab-connect extension. (`connect <port>` stays the CDP-attach command.)
+    if clean.first().map(|s| s.as_str()) == Some("extension") {
+        connect::run_connect(&clean, flags.json);
+        return;
+    }
+
     // Handle session separately (doesn't need daemon)
     if clean.first().map(|s| s.as_str()) == Some("session") {
         run_session(&clean, &flags.session, flags.json);