test(e2e): tab-scope the toolbar-icon spec's action assertions

[rejifald]

What

De-flakes apps/e2e/src/offline/toolbar-icon.behavior.spec.ts ("blocking + count badge on a Russian feed" timed out on PR #247's CI run, which doesn't touch the toolbar path) by scoping every icon/badge assertion to the tab under test. Test-only — no product code changes.

Root cause

The failing poll was pinned at Received: "active" for its full 8s while the DOM guard had already confirmed concealment — so the blocking update did fire; the observation layer lost it:

• lastIconState() read the globally last setIcon spy record, and actedTabBadge() derived its tab from the globally last setBadgeText record.
• A non-web tab — the install-time onboarding tab or the launch-initial blank tab — resolves url: undefined → noPage hero → active posture in resolveActionIconState.
• Under CI load the onboarding tab's onActivated/onUpdated repaint lands seconds late, after the youtube tab's blocking paint. Nothing repaints the youtube tab again, so both .at(-1) reads stay pinned to the wrong tab until timeout.

The mechanism was reproduced deterministically: forcing that late onboarding-tab activation after the blocking paint flips the old global read to active (the exact CI signature) while a tab-scoped read stays blocking.

Fix

• Tab-scoped icon assertions — tabIdFor() resolves the tab under test via chrome.tabs.query on the fixture URL (brief bounded retry); lastIconState(sw, tabId) filters spy records by it. (setIcon still needs the spy — there's no getIcon API.)
• Badge read from browser truth — real per-tab getBadgeText({tabId}); the setBadgeText spy is removed.
• off/exempt — bringToFront() again after the settings flip: refreshActiveTabs() repaints only the active tab, so this guarantees an onActivated repaint of the test tab even if the onboarding tab held focus at flip time.
• exempt badge clear is polled — refreshTabIcon writes icon-then-badge, so the icon reading exempt doesn't yet prove the badge write landed.
• apps/e2e/AGENTS.md spec-table row updated to match (prettier renormalized the table's column padding, hence the whitespace-only line changes).

Reviewer notes

• The SW's tabs.query returns no url for chrome-extension:// / about:blank tabs (<all_urls> host permissions don't cover those schemes; Movar deliberately lacks the tabs permission) — that's why tabIdFor matches the http(s) fixture URLs, which are visible under the e2e build's granted host permissions.
• Product behavior is correct as-is: refreshTabIcon paints per-tab and Chrome holds per-tab icon/badge state; the global last-call read was simply the wrong observation point.

Verification

Run	Result
Fixed spec, --repeat-each=10 --workers=2 (CI parity, 40 tests)	40/40
Blocking test, --repeat-each=25 --workers=6 (stress)	25/25
Deterministic mechanism repro (temp spec, not committed)	old read pins active, tab-scoped stays blocking
tsc --noEmit, eslint, prettier	clean

🤖 Generated with Claude Code