v1.8.0 — visible session windows & real pointer events

The human-login loop is closed: visible session windows + real pointer events.

• session_show / session_hide — a ghost session can come on-screen with its page state intact (setReleasedWhenClosed:false — a user-closed window is recoverable too), for the one thing automation can't do alone: the first human login (OAuth, 2FA, a captcha, a password manager). Park it off-screen again and the agent keeps driving. This is the loop the new demo/dailydev recipe runs in production.
• /click now dispatches PointerEvents (pointerover/pointerdown/pointerup) before the mouse events — Radix and headless-UI components open like they do for a human. Found in the wild: the kebab menu on daily.dev would not open without them.
• macOS /wait fix — the bridge stringifies JS booleans as 1 (NSNumber description), the probe compared against true, so every present selector "timed out". The probe now accepts both spellings.
• webviewkit — the backend contract is now a single kit trait, compile-enforced per backend instead of trusted by convention.
• Tollbooth round 2 — the walled-web bench now measures x402/paywall signals (HTTP 402, X-Payment*/X402* headers, schema.org isAccessibleForFree:false) alongside robots.txt AI clauses and llms.txt adoption: 200 URLs × 5 categories, dataset committed under CC BY 4.0 (bench/tollbooth-results.{json,csv} + bench/DATASET.md).

Binaries for macOS arm64, Windows x64, Linux x64 + arm64.