v1.11.0

## Windows Support

Windows users can now build and run camofox-browser without WSL or `make`.

This release adds a PowerShell `build.ps1` workflow, enforces LF line endings for shell scripts, and fixes Docker builds from Windows checkouts by invoking shell scripts through `sh`. Plugin loading also works correctly on Windows now: plugins are imported via `file://` URLs instead of raw filesystem paths.

## OpenClaw Compatibility

OpenClaw 2026.5.x requires packages to declare tool ownership in `contracts.tools`. camofox-browser now ships that manifest metadata, fixing tool registration failures in newer OpenClaw versions.

Fixes #3141 and #3392.

## Cross-Origin Iframe Interaction

Accessibility snapshots now traverse supported iframes, and refs can resolve back into their owning frames. This makes embedded checkout/payment fields visible and clickable through the normal ref-based flow.

Tracking and analytics iframes are filtered out so snapshots stay focused on actionable page content.

## Security Hardening

Several sensitive routes now require configured auth:

- `POST /tabs/:tabId/evaluate`
- `DELETE /sessions/:userId`
- `POST /pressure/cleanup`

Cookie import now uses the shared auth middleware too. If you expose camofox-browser beyond loopback, verify your `CAMOFOX_API_KEY` / `CAMOFOX_ACCESS_KEY` setup before upgrading.

## Production Reliability

This release pulls in reliability fixes from jo production usage:

- Idle shutdown no longer leaks orphaned Camoufox processes
- Browser close now force-cleans escaped child processes
- Health checks stay green after idle browser shutdown
- Stale tab errors are clearer and more recoverable
- Active tab operations refresh session access time so live sessions are not expired
- Popups from `target=_blank` and `window.open` are tracked as managed tabs
- Tab operations are better serialized with per-tab locks
- Navigation timeout cleanup avoids poisoning proxy-backed sessions
- YouTube transcript session cleanup handles races more safely
- Crash/stall reporter no longer treats `429` relay responses as successful delivery

## Fixes & Improvements

- Prometheus metrics are lazy-loaded and disabled by default unless explicitly enabled
- Snapshot size metrics added
- Navigate requests are aborted when their tab is deleted
- Retry-path `const` reassignment crashes fixed
- VNC plugin config is explicit and disabled by default
- Optional Sentry integration no longer prevents server startup when Sentry is not installed

## Thank You

Thanks to:

- @kgarg2468 — OpenClaw contracts and Windows/Electron feedback
- @SirBrenton — reporter 429 handling
- @sebastiondev — auth hardening
- @Chen-538 — Windows plugin loading fix
- @dawsman — VNC config cleanup
- @pasmud — Windows build support