fix(spec): leave the head subtree out of the web target walk

collectTargets walked querySelectorAll("*") while the hierarchy dump skips head,
so the two hosts enumerated different element sets on every page with a <head>.
No candidate changes: builtinCandidates pushes only for targets acceptsTarget
admits, and head elements have no positive bounds, so the list the draw ranges
over is untouched. What changes is that targetIndex now means the same thing on
both hosts.

Claude-Session: https://claude.ai/code/session_01A5KmftdEJ49A9z5mF5ESrX

pkg/spec/src/web-runtime.ts

@@ -514,6 +514,21 @@ function pointOf(element: Element): Candidate {
   };
 }
 
+// HEAD_SELECTOR is the one subtree the enumeration leaves out. It never renders,
+// so no verb can reach it, and the hierarchy dump the goja host reads
+// (internal/driver/chrome/driver.go) drops it as well. Enumerating it here would
+// put the two hosts on different element sets for every page that has a <head>.
+const HEAD_SELECTOR = "head, head *";
+
+// targetElements is the walk the target list is built from: the document in
+// pre-order, minus the head subtree.
+function targetElements(): HTMLElement[] {
+  const inHead = new Set<Element>(Array.from(document.querySelectorAll(HEAD_SELECTOR)));
+  return Array.from(document.querySelectorAll<HTMLElement>("*")).filter(
+    (element) => !inHead.has(element),
+  );
+}
+
 // collectTargets walks the document ONCE and reports every element with the facts
 // the shared eligibility rule reads. The tappable/editable membership sets are
 // resolved by selector first so the DOM's answer to "clickable" and "editable"
@@ -525,7 +540,7 @@ function collectTargets(): TargetElement[] {
       isEditableElement,
     ),
   );
-  return Array.from(document.querySelectorAll<HTMLElement>("*")).map((element) => ({
+  return targetElements().map((element) => ({
     ...pointOf(element),
     clickable: clickable.has(element),
     enabled: !(element as HTMLButtonElement).disabled,
@@ -577,6 +592,7 @@ export const __testing__ = {
   host,
   seedBigInt,
   collectTargets,
+  targetElements,
   TAPPABLE_SELECTOR,
   EDITABLE_SELECTOR,
   resetTargetCache,