feat(goto): widen autoconsent heuristics and fix consent fallback inj…

[Kikobeats]

…ection

Maximize @duckduckgo/autoconsent coverage:

• heuristicMode 'reject' -> 'tier2': when no reject button exists, click the acknowledge button (ok/got it), else a lone accept button. All tiers stay gated on consent-text detection, so this only affects cookie banners.
• enablePopupMutationObserver: react to DOM mutations instead of only polling, catching banners mounted late by SPAs.
• heuristicPopupSearchTimeout 100 -> 500ms: avoid truncating the popup DOM scan on heavy pages.

Fix runAutoConsent fallback: it re-evaluated the autoconsent script without the nonce guard, so on documents where the new-document injection never ran (the only case the fallback exists for) every message was dropped by the nonce check and autoconsent stayed dead. The full injection (guard + script) is now stored on the page and reused by the fallback.

---

Note

Medium Risk
In-page auto-clicks affect real page DOM during navigation; guards limit scope but mis-clicks on unusual modals remain possible, and tier2 heuristics change consent-banner button choice when reject is absent.

Overview
Improves cookie-banner handling under adblock: true and adds a separate path for non-consent announcement modals.

Autoconsent now uses heuristicMode: 'tier2' (prefer reject, else acknowledge / lone accept), a longer heuristic DOM scan (heuristicPopupSearchTimeout: 500), and enablePopupMutationObserver for late-mounted banners. The post-navigation runAutoConsent fallback re-runs the stored nonce guard + script (page._autoconsentScript) so init messages are not dropped when evaluateOnNewDocument never ran.

New dismiss helper (also gated on adblock: true) injects a narrow in-page scanner for ARIA/<dialog> announcements without consent copy, clicking only safe acknowledge/close buttons (skipping consent-themed and most form dialogs). It runs at setup and again after navigation alongside autoconsent; README documents the behavior.

Unit tests cover heuristic banners, the autoconsent fallback handshake, and dismiss edge cases.

^{Reviewed by Cursor Bugbot for commit 02e2552. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6a55988. Configure here.}