feat: invoke registered page tools

[jmagar]

Summary

• add call-scoped page.call routing pinned to an explicit browser document and catalog revision
• bridge bounded tool execution and cancellation through the authenticated extension channel
• record metadata-only invocation audits and expose separate read/call credentials

Verification

• mix compile --warnings-as-errors
• mix test (70 passed)
• mix credo --strict
• npm test --prefix extension (12 passed)
• MIX_ENV=prod mix assets.deploy
• git diff --check

Boundaries

• Webby remains independent of Labby
• production asset build completed; dependency compiler warnings are upstream warnings
• a live Chrome extension/WebMCP page acceptance run is still required on a browser with the WebMCP origin trial/API enabled