fix: resolve Hermes-found CLI bugs (wait --url, find role, invalid selector, polish)

- wait --url: the arg parser never read `--timeout`, so a non-matching pattern
  waited the large default and wedged the daemon. Parse it. Also: matching was a
  literal substring (`includes`) so globs never matched — convert `**`/`*`/`?`
  globs to an anchored regex. And `poll_until_true` now bounds each probe with a
  timeout and tolerates transient navigation errors, so a hung `Runtime.evaluate`
  can never block past the deadline (un-wedges the daemon).
- find role <role> [--name]: the query was `[role="X"], X`, which matches a
  literal <X> tag / explicit attribute but NOT implicit-role elements — so
  `find role link` (<a href>) and `find role heading` (<h1>) never matched. Add a
  proper ARIA-role → implicit-element map and broaden accessible-name matching
  (aria-label/title/alt/value/text).
- click on a syntactically-invalid selector returned `✓ Done`: querySelector
  throws, and Runtime.evaluate returned the thrown DOMException as an objectId
  that was clicked as if it were the element. Check exception_details → error.
- output: a title-less page now prints `✓ <url>` instead of an empty title line.
- docs(skill): tab refs are `t2`, not `2` (SKILL.md, electron).

Verified live (isolated launch): wait --url glob matches instantly; non-matching
honors --timeout (2s) and leaves the daemon responsive; find role link/heading
match; invalid selector errors. Unit tests added for the glob + role map + parse.

cli/src/commands.rs

@@ -540,7 +540,7 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
 
         // === Wait ===
         "wait" => {
-            // Check for --url flag: wait --url "**/dashboard"
+            // Check for --url flag: wait --url "**/dashboard" [--timeout ms]
             if let Some(idx) = rest.iter().position(|&s| s == "--url" || s == "-u") {
                 let url = rest
                     .get(idx + 1)
@@ -548,7 +548,15 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
                         context: "wait --url".to_string(),
                         usage: "wait --url <pattern>",
                     })?;
-                return Ok(json!({ "id": id, "action": "waitforurl", "url": url }));
+                let mut cmd = json!({ "id": id, "action": "waitforurl", "url": url });
+                // Parse --timeout (without it the default applies — and a
+                // non-matching pattern would otherwise wait the full default).
+                if let Some(t_idx) = rest.iter().position(|&s| s == "--timeout") {
+                    if let Some(ms) = rest.get(t_idx + 1).and_then(|s| s.parse::<u64>().ok()) {
+                        cmd["timeout"] = json!(ms);
+                    }
+                }
+                return Ok(cmd);
             }
 
             // Check for --load flag: wait --load networkidle
@@ -3803,6 +3811,20 @@ mod tests {
         assert_eq!(cmd["url"], "**/dashboard");
     }
 
+    #[test]
+    fn test_wait_url_with_timeout() {
+        // --timeout must be parsed for the --url path; without it a non-matching
+        // pattern waits the full default (and could wedge the daemon).
+        let cmd = parse_command(
+            &args("wait --url **/dashboard --timeout 3000"),
+            &default_flags(),
+        )
+        .unwrap();
+        assert_eq!(cmd["action"], "waitforurl");
+        assert_eq!(cmd["url"], "**/dashboard");
+        assert_eq!(cmd["timeout"], 3000);
+    }
+
     #[test]
     fn test_wait_load() {
         let cmd = parse_command(&args("wait --load networkidle"), &default_flags()).unwrap();