Support bounded same-extension command handoff with explicit launch context #100

Part of #1/#72/#95, with the reviewed-input boundary in #19.

The frozen Quick Translate wrapper (archive SHA-256 9ecbb40257fbc1d0d32778efa95c1392fc6c46d03eb6099e3995a73b6e16eec2, command 597e079da9f40604482472c94e3810d6654415aaf04477371441c9c7fbfdf521) reads explicitly reviewed text, then requests quick-translate-view with JSON context. On the verified ed38313 app (de99960d…1d5e18d), the actual tablet reviewed Run reports launchCommand is not supported on Android. The source text/range and clipboard stay unchanged; all 18 restoration checks pass. This is an observed host boundary, not a service failure. The first test-only startup-clock failure remains excluded; the usable observation uses harness 900f3de / test APK 52c16477…1971a. Durable captures will accompany the #95 observation PR.

Acceptance:

1. Support an explicitly bounded foreground handoff to a supported command in the same installed extension. Validate the exact current invocation, target identity/mode, required configuration and options before changing state. Reject missing, disabled/unavailable, cross-extension and background targets with clear errors unless separately implemented.
2. Deliver copied, bounded JSON context through launchProps.launchContext and declared arguments through launchProps.arguments; ordinary launches and subsequent invocations must not inherit old context. Document any Date/Buffer/fallbackText limits rather than claim full API conformance.
3. Transfer ownership once. Revoke the parent's raw reviewed-input grant; give the child only explicit context already produced by the approved parent. Preserve the external source-return route independently. Old render/status/finished/copy/network callbacks, queued duplicate launches, closed/replaced sessions and stale owners must not alter the child.
4. Handle launch acknowledgement and parent disposal coherently. A successful launch Promise concerns initiation, not child completion. Cancellation or replacement before commit must prevent the handoff; errors leave a recoverable current UI.
5. Use common-harness old/current controls. Establish the real frozen Quick Translate child transition, initial context text, owned subsequent service response/native publication/fresh exact Copy, and unchanged external source return on tablet/phone. Exercise error/ownership/lifecycle boundaries with owned deterministic probes and readable 200%/short-landscape states.
6. Preserve upstream generated assets/notices, installed data and clipboard. Publish real Android boundary/destination/return PNGs and source/binary receipts; require local checks, actual exact-head hosted CI, two independent gpt-6.1-sol/high audits and expected-head merge.

This does not implement desktop menu bars, automatic paste, AI providers, cross-extension permission flows or whole-Store parity. API reference: Command and Lifecycle.