#148 Make chrome-mcp the default agent provider with an auto-connect preflight

Why

Chrome DevTools MCP drives the user's real Chrome with their sessions, which is the better default for reverse engineering logged-in sites. Headed chrome-mcp only works once auto-connect is enabled, and chrome-mcp runs save no HAR, so both need clear, early failures.

What

• New configs default to agent_provider: "chrome-mcp". Existing config.json files keep the provider they store; auto (Playwright MCP + HAR) stays available.
• chrome_mcp.py checks auto-connect the way chrome-devtools-mcp does: DevToolsActivePort in the stable Chrome profile (honoring CHROME_CONFIG_HOME/XDG_CONFIG_HOME on Linux) plus an open port. Headed runs stop before launching with setup steps and error_kind: config_invalid; agent --dry-run reports chrome-mcp:auto-connect as ok or error. --headless skips it.
• engineer <run_id> on a run without a HAR stops before any model session: chrome-mcp runs (detected from the run's recorded mode) get an explanation, error_kind: misuse and exit 2; other runs name the missing HAR path.
• Pins chrome-devtools-mcp@1.12 (it requires pageId on most tools). The chrome-mcp prompt opens its own tab with new_page, passes pageId, closes only its tab, stops on "Could not connect to Chrome", and only promises the user's sessions on headed runs.
• Playwright prompt: browser_run_code is browser_run_code_unsafe; the nonexistent browser_scroll is gone.
• README, website docs (configuration, agent and engineer modes, overview) and changelog.

Verification

• pytest: 1046 passed, including tests/test_chrome_mcp.py (port file missing, unreadable, out of range, closed and open port; per-platform profile paths; dry-run error/ok/headless; agent --json and interactive fail fast without recording a run; engineer rejects HAR-less runs in text and JSON mode). ruff clean, website builds.
• Real captures from this branch on Node 26 against hn.algolia.com, both status: ok with working clients (30 live results):
  • headed, attached to a real Chrome: the agent only touched its own tab (new_page → close_page), $0.71
  • headless: $1.06
• Fresh HOME (no config, no Chrome profile): default is chrome-mcp; --dry-run, --json, --json-stream and text mode all fail fast with the setup steps; --headless --dry-run passes.
• engineer on the real headed chrome-mcp run exits 2 with the chrome-mcp message in text and JSON mode.

Out of scope

• mypy src locally reports the existing copilot_engineer.py:58 untyped-decorator error, same as on main; CI mypy passes.
• HAR capture for chrome-mcp runs.