iter-144: session hygiene follow-up — consent honesty, BBC CMP, screenshot header freeze

[ractive]

Summary

• launch --auto-consent's JSON field is renamed auto_consent_extension_installed — it can only ever claim the Consent-O-Matic extension was installed (never that a banner was dismissed, since launch returns before any page loads). Real dismiss attestation stays on navigate --auto-consent / consent accept's results.consent.
• consent accept gains a NATIVE_CMP_TABLE for same-origin (non-iframe) CMPs — BBC's own #bbccookies-continue-button — tried before the existing iframe-based CMP_TABLE. Verified live against www.bbc.com/news: {"cmp":"bbc","action":"accepted"}, and the control's bounding rect is zero-size afterward (genuinely dismissed, not just clicked).
• tabs filters out the Consent-O-Matic Options extension tab that --auto-consent leaves open (matches moz-extension:// scheme + all 5 shipped-locale titles), so it never pollutes --tab N indices or total.
• screenshot --full-page freezes position: fixed/sticky elements (pin to absolute at their current on-screen position) immediately before capture and always restores them after — a defensive mitigation for the dogfooding-session-63 duplicate-header report. Note: that specific symptom could not be reproduced in this environment despite a deliberate before/after attempt (fixed and sticky headers at page heights 2,000–20,000px, plus the real BBC page itself) — see DEC-028 and the new test's module doc. Landed as a forward-looking pixel-verified regression guard rather than a reproduced-then-fixed defect.
• Theme F (console-locale reproducibility) re-deferred a second time to kb/iterations/iteration-147-console-locale-repro.md — only an English macOS Firefox is available in this implementation environment, same blocker as iteration-142.

Test plan

• cargo fmt --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace -q all clean

• live_144_auto_consent_field_honest — results.auto_consent_extension_installed=true, old auto_consent key gone

• live_144_no_consent_o_matic_tab_leak — no Consent-O-Matic Options entry in tabs

• live_144_bbc_cmp_dismissed — live against real www.bbc.com, network-gated (FF_RDP_LIVE_NETWORK_TESTS=1)

• live_144_full_page_no_duplicate_header — pixel-decoded PNG row scan on a local deterministic fixture, exactly one header row-run

• cargo run -p xtask -- check-iteration-ready --plan kb/iterations/iteration-144-session-hygiene-followup.md --base origin/main — 10/10 PASS (with FF_RDP_LIVE_TESTS=1 for the dogfood-script gate)## Claims vs code
  <generated 2026-08-12T07:28:22Z by ralph-loop>

• a → ✅ matched in diff

• NATIVE_CMP_TABLE → ✅ matched in diff