v0.6.0

• Detect bot-wall and security-challenge pages (Cloudflare, Turnstile, generic access-denied) on the HTTP fast path, surface them as a page_kind plus warning, and auto-escalate to the real browser path when one is detected.
• Enrich the fetch trace with per-stage timing and status, plus current_stage, capture_reason, wait_mode, wait_satisfied_by, and timeout_ms so agents can see where a fetch spent time and why it captured.
• Add a takeover prepare subcommand that opens a persistent host tab for a human and returns a recommended_url to hand off, with --hard-site to prefer real-display takeover for input-sensitive pages.
• Add a --display-provider flag and route real-display takeover through a named provider abstraction, currently backed by KasmVNC.
• Expose browser auto-wait readiness tuning via --readiness-idle-ms, --readiness-stable-ms, and --readiness-min-text-bytes.
• Rename --timeout to --timeout-ms to make the unit explicit.
• Raise the default per-response network-body capture cap from 1 MiB to 10 MiB.
• Harden container install for display-capable hosts (rebuild, from-source, --with kasmvnc) and accept 'container' as a CLI alias for the Apple runtime.
• Rewrite the skill to require afhttp for a supplied URL instead of web-searching it first, document the default fetch and direct-access/takeover flows, and require container status before container install.