feat(cli): conflict preflight for parallel tasks (bsk preflight)

[dangzitou]

What problem this solves

Addresses #132.

When multiple automation tasks run in the same browser they interfere in
two invisible ways: sessions share one browser profile's cookies, so
two tasks automating the same logged-in site overwrite each other's
page state with no visible error; and when the number of running Agent
Windows no longer matches the number of parallel tasks, tasks share one
session and tab refs (@eN) bleed between them. Nothing in the current
CLI detects either before the damage happens.

How this fixes it

bsk preflight --url <url>… [--expected-parallel <n>] lists sessions
and their agent-scope tabs through the existing system.session_list /
tool.tab_list RPCs and grades what it sees:

• P0 (exit 2) — a target host is already automated by an active
  session's agent tab (same-domain login-state conflict).
• P1 (exit 1) — --expected-parallel exceeds the active session
  count (possible session mixup).
• P2 (exit 0) — no conflict.

The grade is also the exit code, so harnesses can branch on it without
parsing output, and --json emits the full structured report. The
check is strictly read-only — it creates and mutates nothing, so a
wrong answer costs at most a redundant task. Domain comparison uses
URL-normalized hosts, so case differences do not cause false conflicts.

Two things from the issue are deliberately left out to keep this PR
reviewable: the borrowed-tab contention check (an agent rarely knows
the tab id it will borrow before running) and the conflict-resolution
policy, which the issue itself leaves open. Both are natural
follow-ups. Note the SKILL.md side of this workflow is covered by #152.

User impact

An agent harness can gate a parallel task on the grade before starting
it:

bsk preflight --url https://app.example.com --expected-parallel 3
# exit 0 → safe to start, 1 → warn, 2 → refuse

Validation

• cargo fmt --all -- --check, cargo clippy -p bsk --all-targets --locked -- -D warnings, cargo test --workspace --locked (green;
  no new tests included in this PR).
• Local end-to-end runs against a live daemon (macOS): same-domain
  target graded P0/exit 2 against the live session (with Chrome for
  Testing 154 + unpacked extension), unrelated target P2/exit 0,
  --expected-parallel mismatch P1/exit 1, non-URL --url rejected
  as an input error; --json report matches the human output.

[dangzitou]

Note on documentation: #152 (docs(skill): add preflight guidance for parallel tasks) already covers the SKILL.md side of this workflow, so this PR deliberately keeps the doc bundle untouched and sticks to the CLI implementation.