Pup - the AI's own browser

@@ -714,3 +714,32 @@ a global flag. Docs: `RECORDING.md`. **Lesson beyond this bug:** a filed issue can have a correct symptom and a wrong root cause. This one was well written and specific, and still misattributed. Check the report's causal claim against your own code before building the fix it asks for.++## Renderer crash wedges the window / crashed renderers not reaped (issue #16, fixed v1.9.78-1.9.80)++Many heavy-SPA tabs + rapid navigate/eval/screenshot churn on one tab crashed a Chrome-for-Testing+renderer; the window went unresponsive and 5 crashed CfT processes lingered at 8-12 MB. Four fixes:++1. **Detect** — `attachTab` wires `page.on('error')` AND a per-tab CDP `Inspector.targetCrashed`+   subscription; either marks `tab._crashed`. The crash is isolated: other tabs stay drivable.+2. **Fast-fail (pre-check)** — `resolveTabOrError` throws `tab_renderer_crashed` (with a+   reload/navigate-to-recover hint) for a crashed tab, so subsequent verbs never hang.+3. **Fast-fail (first verb)** — the crash event for `chrome://crash` can land ~20s late, right as the+   op times out, so the pre-check misses the FIRST verb. The dispatch's outer catch reclassifies a+   timed-out/detached error into the structured crash error when the tab is now `_crashed`. Net: the+   first discovering verb returns the crash error, not a generic 20s timeout.+4. **Reap on close** — `killBrowserProcess` sweeps any chrome/msedge process still launched with THIS+   profile's `--user-data-dir` after the tree kill, catching orphaned/crashed renderers that+   `taskkill /T` misses. Scoped to the profile dir, so it can never touch the user's real browser.++Recovery: `browser_reload` / `browser_navigate` accept a crashed tab (`allowCrashed`) and clear the+flag once the renderer respawns.++Verified: crash a tab -> first screenshot returns `errorCode:tab_renderer_crashed` (not a timeout);+sibling tab still evaluates; `browser_navigate` to a real URL recovers it; close leaves 0 profile+procs (measured 10 -> 0 via `process_list`, NOT PowerShell — a `powershell -File` invocation kept+dropping to an interactive banner here; `cmd /c` and AD's `process_list` verb are reliable).++**Test gotcha:** do NOT recover a crashed tab with `browser_reload` if you crashed it by navigating to+`chrome://crash` — reload re-loads `chrome://crash` and re-crashes. Use `browser_navigate` to a real+URL, or reload only when the tab's real URL is benign.