feat: add Nova app, fast OCR, and secure Chrome MCP

[bigduu]

Summary

• add an independent Nova.app developer preview and a --connect Unix-socket proxy so macOS Screen Recording and Accessibility permissions are attributed to Nova
• speed up OCR with direct raw capture, one JPEG encode, auto | fast | accurate modes, confidence fallback, and native ROI recapture
• add a secure Chrome Bridge with explicit pairing, exact tab/document routing, navigation revocation, semantic reads, and guarded interactions
• add a pinned chrome-devtools-mcp@1.8.0 sidecar with an isolated profile and privacy-first defaults
• expand macOS packaging/release validation and CI coverage for the extension, native host, and Windows ARM64

Verification

• Chrome extension: npm run check; 119/119 tests
• root Rust crate: 77/77 library tests; stdio E2E 1/1
• DevTools launcher: 2/2 local tests; pinned real-network handshake also verified manually
• native host: 25/25 non-bind tests and strict Clippy
• Windows ARM64 cross-check and Clippy
• release workflow static checks, YAML parsing, and cargo check --offline --locked --all-targets

The current sandbox rejects AF_UNIX bind with EPERM, so its five bind-based native-host tests could not run locally; the Ubuntu CI job runs the complete suite on a normal host.

Release status

This is a developer preview, not a production-ready release. The documented production gates remain:

• Developer ID signing, notarization, and stapling
• macOS audit-token / designated-requirement peer authentication
• real packaged-Chrome E2E coverage
• content-hash/offline locking for the DevTools MCP package
• SHA-pinned GitHub Actions