fix(captcha): report response token state

[alectimison-maker]

Summary

• report responseTokenPresent for each detected CAPTCHA candidate after resolving its exact response field
• combine the canonical and compatibility fields for hCaptcha while keeping sibling widgets isolated
• expose only a boolean and never retain or serialize the response token value

Motivation

Issue #505 notes that CAPTCHA verification currently infers solve state from dialog wording and disappearance even though the widget response field provides a language-neutral signal. This lands the issue's suggested Step 2 as a standalone detection primitive.

Design

The page-side detector reads field.value only after responseFieldIdentity has bound a candidate to its exact field. It immediately reduces that value to a boolean. Empty or unreadable values fail closed as false; the raw value is never placed on a candidate, summary, diagnostic, or trace-facing object.

hCaptcha treats either its canonical h-captcha-response field or its compatibility g-recaptcha-response field as token-present. Duplicate observations preserve a positive boolean without changing candidate ranking.

Chrome and Firefox keep byte-identical frame runtimes, now enforced by a regression assertion.

Testing

• node test/run.js — 1,329 passed; 1 inherited baseline failure (package.json is 25.9.7 while the newest changelog entry is 25.9.0)
• npm run test:security — 60/60 passed
• npm run test:fixtures — 125/125 passed
• npm run test:webmcp — passed against Chrome 150
• npm run test:ci — passed
• node --check src/{chrome,firefox}/src/agent/captcha-frame-runtime.js — passed

Compatibility and risks

This is an additive detection field. It does not change tool arguments, candidate ranking, token injection, paid solving, or the CAPTCHA gate state machine. A response token means the widget produced a token; it does not claim that the site accepted it.

Scope

This intentionally defers the remaining #505 work: classifying vendor challenge frames, consuming the boolean in gate transitions, and demoting English dialog regexes.

Refs #505

[vercel]

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.