feat(connect): per-session Chrome tab groups on the shared real browser

Shared browser, separate tab groups: when an agent drives the user's real Chrome
via ab-connect, every tab it opens lands in a Chrome tab group named after its
--session (stable color per name). Each agent's tabs stay visually separated from
other agents' and from the user's own (ungrouped) tabs. Visibility is NOT
restricted — all agents still see all tabs (per design).

- CreateTargetParams gains an optional non-CDP `agentGroup` hint (skip-if-none),
  so a strict real-Chrome endpoint never receives it
- BrowserManager.agent_group(): Some(session) only when ws_url == the live
  ab-connect relay URL (never on launched/direct CDP); DAEMON_SESSION set at
  daemon start supplies the name; emitted at all createTarget sites (transient
  storage target stays None)
- ab-connect: +tabGroups permission; Target.createTarget reads agentGroup and
  groups the new tab (create/reuse by title, deterministic color), best-effort
- extension 0.3.0 -> 0.4.0; re-signed crx + zip (id unchanged)

Needs the v0.4.0 extension reloaded + a build with this change to take effect.

cli/src/native/cdp/types.rs

@@ -141,6 +141,12 @@ pub struct SetDiscoverTargetsParams {
 #[serde(rename_all = "camelCase")]
 pub struct CreateTargetParams {
     pub url: String,
+    /// Non-CDP hint consumed only by the `ab-connect` extension: the Chrome
+    /// tab-group name to drop the new tab into (per-session grouping on the
+    /// shared real Chrome). `None` on the normal CDP path so a strict real-Chrome
+    /// endpoint never receives an unknown parameter.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_group: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]