fix(mcp): drain a synthesized navigation before the tool replies

A submit click runs the page's form glue and leaves the navigation as
pending state. It becomes a request only when a driving layer converts it.
The CDP path converts it, in Input.dispatchMouseEvent and after
Runtime.evaluate, which is why the same click POSTs over CDP and does
nothing over MCP.

The transport's own pump cannot cover this. It is armed after every
dispatch, but it sits in a biased select behind read_line, so a client that
sends its next tool call immediately, which an agent does, wins that race
every time. The reply is also written before any pump turn could run, so
browser_click answered "Clicked" while nothing had left the process, and
location.href already reported the destination, telling the agent the
submit had happened.

Add settle_synthetic_navigation and call it from every tool that can
synthesize a click, a keypress, or run a script, so the invariant holds for
the surface rather than for one tool. It is a no-op when nothing is
pending.

Fixes #618.