ext: S1 native-messaging spike (ADR 0003) + WebSocket transport

Spike S1 — run on the target machine through real snap confinement
(apparmor snap.firefox.firefox enforced; web-ext's direct-exec of the inner
binary bypasses it, so runs were forced through `snap run firefox`):

  - manifest in ~/.mozilla/native-messaging-hosts/  -> WORKS; host launched
    unconfined with real $HOME and real $XDG_RUNTIME_DIR, bound a socket in
    the real /run/user/<uid>. Corroborated by the machine's 1Password host.
  - ~/snap/firefox/common/.mozilla/native-messaging-hosts/  -> not read
  - /usr/lib/mozilla/native-messaging-hosts/               -> not read
  - flatpak path                                           -> N/A (snap Firefox)

Decision: WebSocket stays the default; native messaging is an opportunistic
upgrade taken only when its handshake succeeds. docs/05 §4 corrected in this
commit to point the snap manifest at ~/.mozilla and mark /usr/lib as
deb/tarball-only. ADR carries a self-contained reproduction; the scratch
harness has been removed.

transport/ (build order item 1):
  - types.ts        VeloxTransport interface + error taxonomy
  - rpc.ts          JSON-RPC id correlation, per-call deadline, AbortSignal
  - backoff.ts      exponential backoff with jitter
  - discovery.ts    52000-52016 scan ordering (last-good port first)
  - websocket.ts    scan -> session.hello -> auto-pair (token in
                    storage.local) -> reconnect; -32001 fatal, refused/
                    rate-limited pairing latches needsPairing (no retry storm);
                    a mid-handshake drop aborts hello immediately
  - native.ts       connectNative(); distinguishes "not installed" (fatal,
                    lets the picker fall through) from a crash (reconnect)
  - index.ts        createTransport() runtime picker + persisted Options override

Toolchain: package.json / tsconfig (strict) / vitest; webextension-polyfill
mocked. 38 tests, incl. the WS suite against a real loopback ws server.
No manifest.json yet, so CI's extension-lint guard stays a no-op.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_012Y9RU58hD1BuwP82DySUHk

extension/tests/transport/discovery.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from 'vitest';
+
+import { candidatePorts, WS_PORT_RANGE } from '../../src/background/transport/discovery.js';
+
+describe('candidatePorts', () => {
+  it('covers 52000-52016 inclusive by default', () => {
+    const ports = candidatePorts();
+    expect(WS_PORT_RANGE).toEqual({ start: 52000, end: 52016 });
+    expect(ports).toHaveLength(17);
+    expect(ports[0]).toBe(52000);
+    expect(ports.at(-1)).toBe(52016);
+  });
+
+  it('tries the last-known-good port first, then the rest ascending, with no duplicate', () => {
+    const ports = candidatePorts(WS_PORT_RANGE, 52009);
+    expect(ports[0]).toBe(52009);
+    expect(ports).toHaveLength(17);
+    expect(ports.filter((p) => p === 52009)).toHaveLength(1);
+    expect(ports.slice(1)).toEqual([...ports.slice(1)].sort((a, b) => a - b));
+  });
+
+  it('ignores a preferred port outside the range', () => {
+    expect(candidatePorts(WS_PORT_RANGE, 40000)).toEqual(candidatePorts());
+  });
+});