docs: README end-to-end limits match what the browser suites do (closes #293)

The window.close override the issue named was removed with #275, so it
needs no entry. Every other place either suite changes or works around
the shipped extension is now listed: the popup loaded in a tab, Chrome's
wait before each site-connection request, its recording wrapper and click
listener, its clipboard grant, two layout tests that write into the page,
the forced leave during a decrypt, and Firefox's setting that forces the
site-connection prompt into a window. Firefox's tolerated error is
described as the leftover it is, with #487 to remove it; the phishing
blocklist is no longer listed as a failing fetch, and two stale figures
are corrected.

Model: opus-5-5

TODO.md

@@ -45,6 +45,20 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-07: The README's end-to-end limits now match what the two browser
+  suites do to the extension
+  ([#293](https://git.eeqj.de/sneak/AutistMask/issues/293)). The `window.close`
+  override the issue named went with
+  [#275](https://git.eeqj.de/sneak/AutistMask/issues/275), so it needs no entry.
+  Added: both suites load the popup in a tab rather than from the toolbar;
+  Chrome waits 1.5 seconds before each site-connection request, records what
+  approval windows send and click, grants clipboard permission, writes text
+  straight into the page in two layout tests, and forces the leave during a
+  decrypt; Firefox forces the site-connection prompt into a window. Corrected:
+  Firefox's one tolerated error, whose cause that fix removed (the entry goes in
+  [#487](https://git.eeqj.de/sneak/AutistMask/issues/487)), the phishing
+  blocklist the extension no longer fetches, and two stale figures.
+
 - 2026-10-07: `script/discard-dist-on-failure` returns the failed step's own
   exit status even when it cannot write its message, to a closed stderr or to a
   pipe nobody reads any more