fix(desktop): pick annotations inside same-origin iframes

[lastobelus]

The browser annotation picker could not select content inside same-origin iframes, including populated srcdoc previews. Pointer events and hit testing stopped at the top document.

Track accessible frame documents and translate selections, highlights, gestures, and screenshot crops into top viewport coordinates. Frame navigation and removal clean up listeners and stale selections; cancellation restores temporary styles. Child-frame input participates in human-control arbitration. Element context preserves the child document URL/title and the nested iframe path through validation and prompt packaging. Ordinary style/text updates invalidate geometry without rescanning the frame tree. Cross-origin support and subframe Node integration remain disabled.

Validation: 151 focused tests, desktop/web/contracts typechecks, scoped lint, and Quick CI passed. A Chromium harness running the actual picker with Electron IPC substituted verified nested/scaled frames, scrolling highlights, marquee selection, style restoration, Escape, frame insertion/navigation/removal, same-origin URL frames, opaque-origin exclusion, and populated editor selection with screenshot crops and annotation payloads. Independent review findings were fixed and rechecked. Rotation, skew, mirroring, and perspective remain unsupported for frame contents.

Synthetic browser evidence (actual picker, substituted Electron IPC):

Before selection	Selected inner-frame crop

Implemented with GPT-6 in the Codex harness.