v0.5.0 — console.error capture scoped to project domains

Added

• Project domains in each project profile. console.error messages are captured only on the domains listed there (comma-separated, *.staging.example.com and localhost supported).

Changed

• BREAKING console.error is no longer captured on every page. The domain list is empty by default, so after this update the extension collects logged console errors nowhere until a domain is filled in. Uncaught errors and rejected promises are unaffected — they are still captured on any page you capture.
• The reason: wrapping console.error makes the extension a frame in the call stack of every console.error on every page. Sites with client-side error telemetry (observed on facebook.com) ship that frame to their own servers, which tells them the user has UsrHelper installed. The extension itself still transmits nothing; this stops it from making other pages report its presence. See docs/superpowers/specs/2026-07-21-console-capture-scope-design.md.
• PRIVACY.md and docs/STORE_LISTING.md updated to describe the narrowed data flow. The <all_urls> justification is unchanged — click path, recording overlays and region capture still require it.