fix(captcha): detect active challenge frames

[alectimison-maker]

Summary

• distinguish active CAPTCHA challenge frames from ordinary checkbox/anchor frames
• arm the CAPTCHA gate from visible reCAPTCHA, hCaptcha, and Arkose challenge routes without relying on English dialog copy
• keep Chrome and Firefox routing, diagnostics, and regression coverage aligned

Motivation

The gate currently starts from English phrases such as "Security verification".
Localized challenge dialogs therefore remain unguarded even when the page exposes
a language-neutral vendor challenge frame. This advances #505 after the response
token-state work from #512.

Design

The detector now records a separate activeChallengeFrame signal for exact
vendor routes:

• reCAPTCHA /recaptcha/{api2,enterprise}/bframe
• hCaptcha #frame=challenge
• Arkose /fc/gc/

That signal is deliberately narrower than the existing generic
challengeFrame heuristic. Visible reCAPTCHA anchors, hCaptcha checkbox
frames, hidden frames, generic application CAPTCHA paths, and spoofed vendor
hostnames cannot arm it.

For an accessibility-tree result, local CAPTCHA detection runs early only when
the tree already exposes a dialog surface. Before the first mutation, the
existing read-only page preflight also recognizes a visible active challenge
frame. Supported visible frames route to solve_required; Arkose and
solver-disabled cases continue to fail closed as manual_required.

Testing

• node test/run.js — 1354 passed; 1 inherited failure because
  package.json is 26.0.1 while the newest CHANGELOG.md entry is 26.0.0
• node test/security/injection-corpus.mjs — 60/60 passed
• node --check for both agent.js, captcha-gate.js, and
  captcha-frame-runtime.js copies — passed
• Chrome/Firefox byte-parity checks for the mirrored CAPTCHA helper modules —
  passed
• git diff --check — passed

Compatibility and risks

No public API, permission, network, or storage behavior changes. The remaining
risk is vendor URL drift; exact route matching intentionally prefers a missed
new route over a false-positive gate.

Scope

This PR does not add localized phrase tables, rewrite verification-state
cleanup, or detect full-page Cloudflare interstitials. Those remain separate
steps in #505.

Advances #505.