…mands

Reads the app-under-test DOM directly over CDP instead of serializing it
in the runner page:

- Removes the app-side `snapshot` and `dom` tap commands (and their
  helpers/specs). Historical DOM will come from pinning a command (next),
  and live DOM now comes from CDP.
- Extends `withTapSession` to expose the attached CDP client + session so
  extractors can run Page/DOM/CSS/Accessibility against the AUT frame.
- Adds `resolveAutFrame`: the AUT is a same-process child frame of the
  runner page (name `Your project: '<name>'`) — verified empirically to
  be a child frame, not an OOPIF, so one attached session reaches it.
- Adds the CLI-native `tap frame` command group and `frame dom`, which
  reads the current AUT DOM (whole page or a selector's matches) via an
  isolated world, capping output browser-side.

`frame ax`, `frame inspect`, and the binding `pin` command follow. The
frozen getSchema/exec contract is unchanged; `frame` is CLI-native.

`cypress tap frame ax [selector]` returns the app-under-test's
accessibility tree — roles, names, values, and key states — from
Accessibility.getFullAXTree scoped to the AUT frame, projected to a
compact indented tree (noise roles collapsed, ignored nodes dropped)
with a --max-nodes cap. A selector roots the read at a subtree by
matching the element's backend node id; a non-matching selector is an
empty result, a malformed one is INVALID_SELECTOR.

`cypress tap pin <test> <command> [--at]` renders a command's captured
DOM snapshot into the live app-under-test frame (via the reporter's
restore path), so the CDP `tap frame` commands can read that historical
moment — its HTML, accessibility tree, computed styles — deterministically
instead of whatever the live frame happens to show. `pin --clear` restores
the pre-pin DOM; it is idempotent.

The pin is app state that persists between tap calls (each CLI call is a
fresh CDP connection, so no handle crosses them). Guards: NO_RUN,
RUN_IN_PROGRESS, ALREADY_PINNED (one pin at a time), TEST_NOT_FOUND,
COMMAND_NOT_FOUND, SNAPSHOT_UNAVAILABLE, SNAPSHOT_NOT_FOUND. The snapshot
store's pinned flag is set so the reporter's hover machinery can't clobber
the pinned DOM.

- `cypress tap frame inspect <selector>` returns one element's tag,
  attributes, curated computed styles, box rect, and accessibility node.
  It reads the element's info in an isolated world (getComputedStyle /
  getBoundingClientRect on the element) and takes only the AX node from
  CDP — avoiding the brittle requestNode/nodeId path.
- `run-state` (and therefore `status`) now reports the currently pinned
  command, so a pin is always visible and a stranded one is recoverable.

Align with Playwright's naming for the accessibility tree (its ariaSnapshot
/ toMatchAriaSnapshot API and the "aria snapshot" its agent tooling
returns). `tap frame ax` becomes `tap frame aria`; the extractor, its
result types, and the per-element accessibility field on `frame inspect`
follow suit. CDP protocol identifiers (AXNode, getFullAXTree) keep their
names.

A pin leaked across spec switches and re-runs: the module-level pin state
survived, so `status` kept reporting a pin that no longer existed and a
`pin --clear` could restore a stale snapshot over the new run's DOM.

Reconcile the pin against the current run before every pin/status/clear:
the pin is live only while the exact snapshot object it rendered is still
the command's current snapshot. A re-run re-captures fresh objects (even
when the log id is reused) and a spec switch drops the command entirely —
both fail the identity check, so the stale pin is released without
restoring its now-gone DOM.

Route the pin through the app's native pin so the AUT shows the pinned banner/controls and the reporter command log reflects it — the pinned command highlights and its test opens (mirrors the existing unpin notification). Re-pinning the same command with a new --at now moves the pin to that snapshot in place instead of erroring ALREADY_PINNED; a different command still requires a clear first.

… and inspect