feat(chrome): read the page's exceptions and navigations, and hold the picker state across them

a page navigation replaces the runtime, so the seeded picker restarted the seed's stream at its first draw on every reload and a trace could not tell a reload from a generator repeating itself. the driver now drains the main-frame navigations it saw, reports the page's buffered uncaught errors so state.exceptions is the page's list on the goja host too, and carries the picker's draw position out of v8 and back in around each decision.

pkg/spec/test/pcg.test.ts

@@ -56,3 +56,17 @@ for (const c of cases) {
     });
   }
 }
+
+// A web run's runtime is reinstalled by every page navigation, so the host
+// carries this pair across and the seed's stream stays one stream. A restore
+// that lost a bit would silently re-explore ground the seed already covered.
+test("a restored state continues the sequence it was taken from", () => {
+  const source = new Pcg(1n, 0n);
+  for (let draw = 0; draw < 5; draw++) source.uint64();
+  const carried = source.state();
+  const continuation = [source.uint64(), source.uint64(), source.uint64()];
+
+  const fresh = new Pcg(1n, 0n);
+  fresh.restore(carried.hi, carried.lo);
+  assert.deepEqual([fresh.uint64(), fresh.uint64(), fresh.uint64()], continuation);
+});

pkg/spec/test/picker-stream-probe.ts

@@ -0,0 +1,11 @@
+// The seeded picker, over a page that gets navigated out from under it.
+//
+// internal/driver/chrome/picker_stream_test.go bundles this through the
+// production web bundler and asks for one action at a time. `taps` over a page
+// whose targets never move draws exactly once per call, so the actions it hands
+// back ARE the seed's draw stream, and a stream that restarts is visible in
+// them.
+
+import { taps } from "../src/actions.ts";
+
+export const actionsRoot = taps;