v1.2.0 — Browser-driven real-traffic capture

Added

• Browser-driven real-traffic capture (auto-scanner/integrations/browser_capture.js + browser_capture.sh): drives a real headless Chromium (Playwright) against one authorized URL and records every request/response/WebSocket frame the SPA actually makes, with real headers — past client-gating walls (dynamic client-id, Client-Version, anti-automation) that a static curl can't reproduce. Scope-enforced before launch; wired into recon as stage [1.4d]; skipped under --passive-only and when node/Playwright are absent.
• Per-program custom-header injection: resolves a mandatory research/identification header (BB_EXTRA_HEADERS / BB_RESEARCH_HEADER / auto-detected from programs/*.md) and injects it into every captured request, so programs requiring such a header can be scanned without forfeiting eligibility.
• Two-agent research/verify workflow (docs/agent-workflow.md): the investigator + independent-reviewer methodology — every claim executed and observed, severity never inflated, reviewer sign-off before any submission.

Validated end-to-end in an isolated VM (100 real requests captured, mandatory header on every request, scope gate refusing out-of-scope before launch). See #3 / #4.