feat(browser): add zero-click Chrome extension bootstrap (#121586)

* feat(browser): add zero-click extension bootstrap

Pre-register deterministic path-derived extension IDs and install a strict native messaging host.

Keep the popup and options UI minimal while removing the obsolete copilot and page-share flows.

* fix(browser): satisfy native bootstrap CI guards

* test(browser): isolate native bootstrap Chrome roots

* test(browser): flush native bootstrap profile before status

* test(browser): seed Linux native bootstrap identity

* fix(browser): preserve native bootstrap upgrade safety

Allow immutable root-owned package inputs while keeping mutable state, manifests, and launchers user-owned. Preserve all retired copilot keys whenever active or unrecognized recovery custody remains.

* fix(browser): preserve pending copilot custody

Retired cleanup now removes copilot state only when the durable registry is exactly empty. Any session, archive, malformed value, future shape, or read failure preserves every retired key.

* fix(browser): guard native bootstrap upgrades

Fail closed while retired copilot custody remains and make discard durable across partial failures.

Require exact launcher-embedded origins and repair full launcher drift without accepting mismatched registrations.

* fix(browser): remove stale layout export

* chore(release): leave changelog to release flow

docs/cli/browser.md

@@ -122,17 +122,33 @@ System-profile import is enabled by default. Set `browser.allowSystemProfileImpo
 
 ```bash
 openclaw browser extension path
+openclaw browser extension install
+openclaw browser extension install --json --wait-ms 60000
+openclaw browser extension status
+openclaw browser extension status --json
+openclaw browser extension uninstall-host
 openclaw browser extension pair
 openclaw browser extension pair --gateway-url wss://gateway.example.com
 openclaw browser extension cdp
 openclaw browser extension cdp --json
 ```
 
-- `extension path` prints the unpacked extension directory for Chrome's **Load
-  unpacked** flow.
-- `extension pair` creates the host-local relay key when needed and prints the
-  pairing string. `--gateway-url` creates a direct remote-Gateway pairing URL;
-  non-loopback URLs must use `wss://`.
+- `extension install` copies the bundled runtime into a stable state-directory
+  path and pre-registers its deterministic, origin-locked native bootstrap host
+  in existing Chrome-family user-data roots. Launch Chrome, run this command,
+  and use **Load unpacked** only after it prints the stable path. The command
+  waits while Chrome records that exact path, then verifies the recorded ID
+  against Chromium's path-derived ID. **Load unpacked** is the only manual
+  action in normal setup.
+- `extension status` reports the installed copy, detected IDs/profiles,
+  owned-registration health, and whether manual setup is required. JSON output
+  never includes a pairing string or relay key.
+- `extension uninstall-host` removes only verified OpenClaw-owned native-host
+  manifests and launchers. It does not remove the extension from Chrome.
+- `extension path` is read-only. It prints the stable installed copy when
+  present and the bundled source directory otherwise.
+- `extension pair` remains the advanced manual flow. `--gateway-url` creates a
+  direct remote-Gateway pairing URL; non-loopback URLs must use `wss://`.
 - `extension cdp` prints non-secret Browser Relay Authentication v2 metadata:
   the loopback browser/CDP endpoints, protocol version, key ID, and fixed
   challenge/complete binding. It never prints the relay key or an authorization
@@ -146,6 +162,11 @@ on stderr so stdout stays valid JSON.
 
 Setup, security model, and migration steps: [Chrome extension](/tools/chrome-extension).
 
+If the extension already attempted automatic setup before the native host
+existed, Chromium retains that miss for the running browser process. Restart
+Chrome once, then repeat the ordered install flow; popup retries alone cannot
+recover that existing process.
+
 ## Tabs
 
 ```bash