fix(extension): prevent idle Flow tab leaks

[Bl0ck154]

Summary

Fixes a tab leak in the MV3 extension that can accumulate many flow.google.com tabs even while no generation is running.

Root causes

• the periodic token-refresh alarm could create a Flow tab when none was open;
• after the old labs.google/.../flow URL redirects to flow.google.com, stale deployments can repeatedly decide that no usable Flow tab exists;
• CAPTCHA recovery created a fresh tab but then re-queried all tabs and could pick an older stale tab again, leaking the newly-created tab;
• batch RPC recovery had the same re-query pattern.

Changes

• passive token refresh never creates tabs; only explicit refresh/RPC paths may open Flow;
• recovery paths retain the exact newly-created tab ID instead of selecting fresh[0] from a re-query;
• temporary CAPTCHA recovery tabs are removed after the attempt;
• extension reports its live version and flow.google.com host support to the agent health state;
• docs/setup guidance now points users to flow.google.com instead of the legacy labs URL;
• bumps the extension to 0.3.1;
• adds a regression assertion that the passive token-refresh alarm creates zero tabs.

Validation

• node --test tests/extension_mv3_bootstrap.test.cjs passes on this branch.
• agent/services/flow_client.py compiles cleanly.
• The same extension fix was deployed against a persistent Chrome profile and verified to remain connected without creating idle Flow tabs.

The self-hosted CRX deployment/idle-browser parking pieces used by my deployment are intentionally not included in this PR, so this stays focused on upstream-portable behavior.