feat: ship protocol 3 and semantic browser elements

[gcharang]

Summary

• hard-cut the wire contract to protocol 3 and ship the extension-local payment-card vault
• add guarded staging/production deployment workflows and release evidence
• add bounded semantic element capture, search, inspection, deltas, and ref-based actions across protocol, extension, backend, and connector
• align Changesets, changelogs, package docs, operational handoffs, and verification records with the implemented release state
• require an acknowledged local card commit before the side panel clears sensitive enrollment fields
• eliminate every high and critical npm advisory path while retaining the seven-day dependency quarantine

Release metadata

• @understudy/protocol: minor, 0.8.0 to 0.9.0
• @understudy/connector: minor, 0.5.1 to 0.6.0
• private backend and extension apps remain at 0.2.0 and are excluded from Changesets versioning and tagging
• a clean Changesets preview generated one changelog section per public package and no duplicate app bumps
• three newly published security patches have exact-version release-age exemptions; later versions remain quarantined

Verification

• pnpm typecheck
• pnpm test (778 tests across package and integration suites)
• pnpm build
• pnpm --filter @understudy/extension test:e2e
• pnpm --filter @understudy/extension zip:store (142,127-byte store ZIP)
• pnpm audit --audit-level high (0 high/critical; 2 moderate and 2 low transitive findings remain)
• production and staging Wrangler type/dry-run gates
• clean-code, architecture, and QA review lanes: clean

Prepared and reviewed with OpenAI Codex. Prompts focused on release integrity, documentation accuracy, clean code, architecture, and QA edge paths.