fix(relay): pin Chrome Web Store origin

[kitlangton]

What

Pin production WebSocket access to Chrome Web Store extension ID gmjpoplfomnnjipeiojccjbpjlodkjhn and bump the Store package to 0.0.23.

Before / After

Before: any installed Chrome extension could connect to the production relay's extension or browser websocket endpoint.

After: packaged relays accept only the assigned Browser Control Store origin. Source-mode relays retain an explicit permissive path for unpacked extension development and isolated tests.

How

• define the assigned Store origin in src/relay-helpers.ts
• allow arbitrary chrome-extension:// origins only when browserControlVersion === "0.0.0-dev"
• enforce the same origin policy on extension and browser websocket upgrades
• record the assigned ID in the Store submission guide
• add a Changesets patch entry

Scope

This does not upgrade the currently running shared relay. The published follow-up should be installed together with the approved Store build so the existing unpacked extension is not disconnected prematurely.

Testing

• pnpm run ci
• 42 test files / 383 tests
• deterministic Store package validation
• artifacts/browser-control-extension-0.0.23.zip
• SHA-256: 982e2fa12d83d5ef54dc976b28ad9fd5341264d7996ae8253a6520ee6dbab869