#443 Reagan/hitl

Summary by cubic

Adds three human-in-the-loop blocks: login for credential entry, capture for reCAPTCHA tile selection, and iframe for embedding a live URL inline. This lets agents pause, collect input safely in chat, or let users complete a remote step, then resume browser automation.

• New Features

  • Renderer: added LoginForm, CaptureBlock, and IframeBlock with transcript-based hydration.
  • Parser: htmlBlocks now recognizes login, capture, and iframe fences with strict JSON validation (LoginPayload, CapturePayload, IframePayload + parsers).
  • Engine prompts: added loginBlockGuidanceLines() and wired into browsercode, claude-code, and codex.
  • Chat wiring: ChatTurn dispatches all new blocks; ChatPane listens for chatv2:open-browser; CSP updated to allow frame-src 'self' https:.
  • Docs: added capture-block.md (per-tile-union recipe, cross-origin bframe via session.use(), verification) and iframe-block.md (when to use, limits).
  • Tests: unit tests for capture parsing/UI and iframe streaming/parser (CaptureBlock.spec.tsx, captureBlocks.test.ts, iframeBlocks.test.ts).

• UI Improvements

  • CaptureBlock: reCAPTCHA-style banner (lead/bold/trailer, optional targetImage), NxM CSS tiling, clear submitted state; guarded submit when the sessions IPC bridge is missing.
  • IframeBlock: sandboxed frame with “I’m done”/“Skip” foot actions; read-only (no DOM access).
  • OptionList: restored outer card chrome and added streaming skeleton cards.
  • Scoped styles (captureBlock.css, loginForm.css, iframeBlock.css) and minor polish across blocks.