🐛 fix: preserve browser errors and scope metadata headers

[vaayne]

Summary

• preserve structured agent-browser batch --json failures on non-zero exits
• keep bb-sites domain semantics unchanged; Tap does not block cross-origin fetches
• inject Tap-configured metadata headers only into requests targeting the declared domain
• stop installing metadata headers as browser-wide navigation headers
• preserve headers from Request inputs and explicit init.headers

Contract boundary

Tap remains compatible with bb-sites as-is. domain continues to provide the navigation context and metadata; it is not promoted into a Tap network allowlist. Cross-origin requests remain governed by the browser's CORS/CSP behavior.

Tap only uses domain to scope its own configured credentials. A cross-origin script request can proceed, but it never receives headers resolved from Tap metadata. Scripts may still provide their own explicit request headers.

This is a trusted-script fetch contract, not a malicious-JavaScript sandbox.

Verification

• mise run lint && mise run test
• go test ./... -timeout 60s -race
• generated wrapper test confirms there is no Tap cross-origin blocker
• generated wrapper test confirms metadata headers are origin-scoped and absent from browser navigation
• structured failure test surfaces TypeError: Failed to fetch instead of exit status 1