fix(apps): address review of app-rendered elicitations

Eight findings from the Copilot review, all accepted.

Ownership across connections was the substantive one, in three parts. A
mid-session transport close reaches teardown only through
`clearAndAnnouncePendingPeerRequests`, whose emptiness check looked at the
native queues alone — so a lone app elicitation survived a dropped connection
with its modal still open; the check now counts the active set too. The web
bridge factory resolves its client at call time, so an entry queued by a
replaced `InspectorClient` could rebuild against the *next* one and answer
through a different server; the host now drops every entry synchronously on
the swap (`AppElicitationController.failAll`) rather than racing core's
awaited teardown. And the request id was only monotonic within one client, so
each replacement client's first request was `app-elicitation-1` — settling
that id could resolve the wrong server's request. It now carries a
per-instance prefix.

Result validation now parses the whole value with `ElicitResultSchema` before
the requested-schema check, instead of inspecting `action` by hand: a
`{ action: "decline", content: { x: {} } }` used to pass, though the standard
result permits only primitives and string arrays in `content`.

The dialog's accessible name now includes the request id and the prompt — two
concurrent elicitations can be for the same app URI, and the previous name
made those indistinguishable, which is what the comment beside it claimed to
prevent.

`observeAppCapabilities` takes a minimal structural `onmessage` contract
(generic over the message type, since a handler typed for a narrower message
is not assignable to one typed for `unknown`), removing the double cast at the
call site.

`smoke:web:elicit` now fails on an uncaught page error after a successful
drive, and captures the async half of that class off the console channel, as
its two sibling smokes do — it could otherwise print OK over a broken bundle.

Adds the tests each fix needs, including the two the review asked for
directly: that `advertiseElicitation` reaches the `AppBridge` constructor, and
that it is absent by default.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/smoke-web-elicitation.mjs

@@ -60,6 +60,9 @@ const PORT = process.env.SMOKE_WEB_ELICIT_PORT ?? "6296";
 const TOKEN = "smoke-web-elicit-token";
 const TOOL = "app_choose_option";
 const SHOT_DIR = process.env.SMOKE_SCREENSHOT_DIR;
+// The async half of the uncaught-crash class. Kept identical to
+// smoke-web-browser.mjs / smoke-web-app.mjs.
+const FATAL_CONSOLE = /^Uncaught\b|Failed to fetch dynamically imported module/;
 
 const servers = [];
 let browser = null;
@@ -235,10 +238,20 @@ try {
     viewport: { width: 1280, height: 900 },
   });
 
+  // Uncaught *synchronous* page errors, and their *async* twin (an unhandled
+  // rejection or a failed dynamic import), which Chromium reports on the
+  // console channel instead. Both are hard failures; every other console error
+  // is only a diagnostic, so benign font/React noise cannot flake CI. Same
+  // split as smoke:web:browser and smoke:web:app, which document it at length.
   const pageErrors = [];
+  const consoleErrors = [];
   page.on("pageerror", (err) =>
     pageErrors.push(err instanceof Error ? err.message : String(err)),
   );
+  page.on("console", (msg) => {
+    if (msg.type() === "error") consoleErrors.push(msg.text());
+  });
+  const fatalConsole = () => consoleErrors.filter((m) => FATAL_CONSOLE.test(m));
 
   const drive = async () => {
     // ── 1. Negotiated: the server's app answers the elicitation ────────────
@@ -304,13 +317,26 @@ try {
   try {
     await Promise.race([web.whenChildExits(), drive()]);
   } catch (err) {
+    const diagnostics = [
+      ...pageErrors,
+      ...fatalConsole().map((m) => `console: ${m}`),
+    ];
     await fail(
       `${err instanceof Error ? err.message : String(err)}${
-        pageErrors.length ? ` — page errors: ${pageErrors.join("; ")}` : ""
+        diagnostics.length
+          ? ` — page diagnostics: ${diagnostics.join("; ")}`
+          : ""
       }`,
     );
   }
 
+  // A drive that reached all of its assertions still fails if the page threw on
+  // the way: without this the smoke prints OK over a broken bundle.
+  const fatal = [...pageErrors, ...fatalConsole()];
+  if (fatal.length > 0) {
+    await fail(`page logged uncaught error(s): ${fatal.join("; ")}`);
+  }
+
   console.log("smoke:web:elicit OK — app-rendered and native paths both drive");
   await shutdown();
 } catch (err) {