fix: resolve Hermes-found CLI bugs (wait --url, find role, invalid selector, polish)

- wait --url: the arg parser never read `--timeout`, so a non-matching pattern
  waited the large default and wedged the daemon. Parse it. Also: matching was a
  literal substring (`includes`) so globs never matched — convert `**`/`*`/`?`
  globs to an anchored regex. And `poll_until_true` now bounds each probe with a
  timeout and tolerates transient navigation errors, so a hung `Runtime.evaluate`
  can never block past the deadline (un-wedges the daemon).
- find role <role> [--name]: the query was `[role="X"], X`, which matches a
  literal <X> tag / explicit attribute but NOT implicit-role elements — so
  `find role link` (<a href>) and `find role heading` (<h1>) never matched. Add a
  proper ARIA-role → implicit-element map and broaden accessible-name matching
  (aria-label/title/alt/value/text).
- click on a syntactically-invalid selector returned `✓ Done`: querySelector
  throws, and Runtime.evaluate returned the thrown DOMException as an objectId
  that was clicked as if it were the element. Check exception_details → error.
- output: a title-less page now prints `✓ <url>` instead of an empty title line.
- docs(skill): tab refs are `t2`, not `2` (SKILL.md, electron).

Verified live (isolated launch): wait --url glob matches instantly; non-matching
honors --timeout (2s) and leaves the daemon responsive; find role link/heading
match; invalid selector errors. Unit tests added for the glob + role map + parse.

skill-data/core/SKILL.md

@@ -363,13 +363,14 @@ Pass `--hide-scrollbars false` when launching to keep native scrollbars visible.
 ```bash
 agent-browser tab                      # list open tabs (with stable tabId)
 agent-browser tab new https://docs...  # open a new tab (and switch to it)
-agent-browser tab 2                    # switch to tab 2
-agent-browser tab close 2              # close tab 2
+agent-browser tab t2                   # switch to tab t2
+agent-browser tab close t2             # close tab t2
 ```
 
-Stable `tabId`s mean `tab 2` points at the same tab across commands even
-when other tabs open or close. After switching, refs from a prior snapshot
-on a different tab no longer apply — re-snapshot.
+Tab ids are stable strings (`t1`, `t2`, …), never reused within a session, so
+the same id keeps referring to the same tab across commands. Positional
+integers are **not** accepted — use `t2`, not `2`. After switching, refs from a
+prior snapshot on a different tab no longer apply — re-snapshot.
 
 ### Run multiple browsers in parallel
 

skill-data/electron/SKILL.md

@@ -95,8 +95,8 @@ Electron apps often have multiple windows or webviews. Use tab commands to list
 # List all available targets (windows, webviews, etc.)
 agent-browser tab
 
-# Switch to a specific tab by index
-agent-browser tab 2
+# Switch to a specific tab by id (t1, t2, …; integers not accepted)
+agent-browser tab t2
 
 # Switch by URL pattern
 agent-browser tab --url "*settings*"
@@ -117,7 +117,7 @@ agent-browser tab
 #   1: [webview] Embedded Content        https://example.com/widget
 
 # Switch to a webview
-agent-browser tab 1
+agent-browser tab t1
 
 # Interact with the webview normally
 agent-browser snapshot -i