fix(firefox): block rapid duplicate submits

[alectimison-maker]

Summary

• port Chrome's rapid duplicate-submit protection to Firefox
• extract the existing policy into byte-identical, browser-free helpers for both extension trees
• update Firefox architecture documentation now that the documented parity gap is closed

Problem

Firefox already allocated and cleared _recentSubmitClicks, including after validation-rejected submits, but never consulted it before dispatch. Its architecture documentation explicitly listed this as a limitation. A looping model could therefore click the same Create/Save/Submit-style control twice on the same URL and create duplicate records, while Chrome blocked the second click.

Design

• preserve Chrome's existing submit-label set, per-tab + normalized-label + URL key, 45-second window, error payload, and _allowResubmit escape hatch
• query the current tab URL lazily only for guarded text clicks
• keep restricted-page/PDF handling ahead of the new Firefox guard
• block before Firefox sends the click to the content script
• retain the existing behavior that validation-rejected submits clear the recent-click entry

Testing

• node test/run.js: 1330 passed, 1 inherited failure (package.json is 25.9.7 while the newest CHANGELOG.md entry is 25.9.0)
• direct production-helper coverage for first click, duplicate block, navigation, expiry boundary, explicit retry, ordinary labels, and URL lookup failure
• Firefox Agent.executeTool integration regression proving zero content-script dispatch for a duplicate
• npm run test:security: 60/60
• npm run test:fixtures: 125/125
• npm run test:webmcp: passed with Chrome 150
• npm run test:ci: passed
• helper/Agent syntax checks, helper byte parity, and git diff --check

Compatibility

Chrome behavior is preserved. Firefox gains the documented duplicate-submit safety behavior; ordinary clicks, navigation, expired entries, explicit retries, and corrected validation failures remain allowed.

[vercel]

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.