chore(host-browser): Phase 2 polish + hardening (P3 cleanups)

[noanflaherty]

Summary

• Derive HOST_TOOL_NAMES from HOST_TOOL_TO_CAPABILITY so the invariant is structural
• Delete dead chrome-extension wiring in handleConversationCreate (zero callers in production code)
• Add explicit assert in prepareConversationForMessage to fail loudly if chrome-extension reaches it
• Add tsc --noEmit step to chrome-extension build.sh so type errors are caught at build time
• Tighten host-browser-routes.ts non-null assertion with an explicit guard + 400 response
• Resolve chrome-extension registry guardianId at send-time from conversation.trustContext instead of captured per-POST authContext
• Add parseHostHeader IPv6 edge-case unit tests (table-driven)
• Add Phase 3 hand-off comments to verifyHostBrowserCapability and browser-session/index.ts

Addresses items 6-13 from the round-4 self-review of PR #24159.

Original prompt

one PR for items 1-5 and also /do in parallel another PR for items 6-13

---

[devin-ai-integration]

Devin Review found 1 potential issue.

View 2 additional findings in Devin Review.

[noanflaherty]

@devin review this PR again — reply posted explaining that ConversationCreateRequest is intentionally retained as part of the wire protocol (actively used by Swift clients). The observation-only thread has been resolved. No code fixes needed.