fix(cli): accept trailing browser --window option

[jackwener]

What

Fixes #1850 by accepting the natural browser command shape:

opencli browser work open https://x.com --window background

--window remains a browser namespace option. Instead of registering it on every browser leaf command, the existing rewriteBrowserArgv preprocessor now hoists a trailing --window <mode> / --window=<mode> into the namespace-option slot before Commander parses argv.

The branch also includes a lockfile-only production dependency refresh for ws and js-yaml because the required CI audit gate flagged the old locked versions. package.json ranges already allow the patched versions, so no range change is needed.

Why this version

This integrates the useful parts of both open PRs:

• PR fix(cli): accept browser --window placed after the subcommand (#1850) #1926 had the lower-blast fix: keep the command tree unchanged and rewrite the user-facing argv shape in the browser preprocessor.
• PR fix(browser): accept --window after the leaf subcommand (#1850) #1899 correctly called out the help/UX confusion and added broader coverage, but the leaf-option mirroring approach is easier to get subtly wrong as the browser command tree evolves. For example, it classifies root browser close as a skipped session command even though browser close routes through browserAction.

This PR uses the preprocessor approach, adds nested-command coverage from the broader concern, avoids rewriting anything after a literal --, avoids hoisting a bare --window without a value, and documents the trailing placement in browser help examples.

Tests

• npx vitest run src/cli-argv-preprocess.test.ts
• npm run typecheck
• npm run build
• HOME=$(mktemp -d) npx vitest run src/cli-argv-preprocess.test.ts src/cli.test.ts
• npm audit --omit=dev --audit-level=high
• HOME=$(mktemp -d) npm test

Supersedes #1926 and #1899.
Fixes #1850.