test: take only an approval window whose approval is still pending (closes #287)

The site-connection tests settle the prompt in a tab while the toolbar
popup for the same approval is still loading. Closing the tab tears that
popup down, chrome.action.openPopup() rejects, and the background opens
its fallback window for the settled approval and removes it again. The
next test took any page at an approval URL, so it could take that
window, which showed the site view and then closed under the wait for
the sign view. The harness now asks the background whether a page's
approval is still pending before taking it.

The blocklist test clicked its self-closing Reject with a plain click;
it now clicks it as the other site Reject does, with the click witnessed.

Model: opus-5-5

TODO.md

@@ -45,6 +45,16 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-04: The Chrome end-to-end suite no longer loses a dApp prompt under
+  load ([#287](https://git.eeqj.de/sneak/AutistMask/issues/287)). The suite
+  drives a site-connection prompt in a tab while the toolbar popup for the same
+  approval is still loading. When the tab settled it first, the toolbar popup
+  closed unloaded, the extension opened its fallback window for the settled
+  approval and removed it again, and the next test could take that window for
+  its own prompt and lose it under its wait. The suite now takes an approval
+  window only while the background still holds its approval. The blocklist
+  test's Reject, whose window closes itself, is clicked as the other site Reject
+  is, with the click witnessed.
 - 2026-10-04: The native token's label follows the network
   ([#372](https://git.eeqj.de/sneak/AutistMask/issues/372)). `networks.js` gives
   each network a `nativeCurrency` and nothing read it: every screen wrote `ETH`,