fix: reject invalid --headers JSON, empty frame commands, and --cdp + --extension combo (#488)

## Summary

- Return a `ParseError` when `--headers` receives invalid JSON instead of silently dropping the headers and proceeding
- Reject `frame` commands that provide no `selector`, `name`, or `url` (previously returned `{ switched: true }` without doing anything)
- Add missing mutual exclusion check for `--cdp` + `--extension` (extensions require a local browser, not a CDP connection)

src/protocol.ts

@@ -1001,6 +1001,14 @@ export function parseCommand(input: string): ParseResult {
     return { success: false, error: 'Either content or url must be provided', id };
   }
 
+  if (command.action === 'frame' && !command.selector && !command.name && !command.url) {
+    return {
+      success: false,
+      error: 'frame command requires at least one of: selector, name, or url',
+      id,
+    };
+  }
+
   return { success: true, command };
 }