fix(spec): keep a selector out of the head subtree

the head renders nothing, so the hierarchy dump drops it and so does the
enumeration the picker walks, but a selector still resolved into it: a
whole-page findAll answered with <head> and <title> here and with
neither on the goja host, which is a divergence the moment a state
selector asks a question every element has an answer to.

pkg/spec/src/web-runtime.ts

@@ -426,12 +426,22 @@ function deepQueryAll(selector: string, root: ParentNode): Element[] {
 
 // matchedElements resolves one compiled selector: the document query first, then
 // the states it named, which no query can express.
+//
+// The head subtree is dropped here the way targetElements drops it from the
+// enumeration and buildTree (internal/driver/chrome/driver.go) drops it from the
+// dump: it renders nothing, so a selector reaching into it names an element the
+// goja host cannot see at all. document.head is absent only from the small fake
+// documents the unit tests install.
 function matchedElements(root: ParentNode, compiled: CompiledSelector): Element[] {
   const { css, xpath, match } = compiled;
   let found: Element[] = [];
   if (css) found = deepQueryAll(css, root);
   else if (xpath) found = evaluateXPathAll(xpath, root as Node);
-  return match === undefined ? found : found.filter(match);
+  const head: Element | undefined = document.head;
+  return found.filter(
+    (element) =>
+      !(head !== undefined && head.contains(element)) && (match === undefined || match(element)),
+  );
 }
 
 function queryElement(