Inject recorder at record time instead of <all_urls> content script

[SaintPepsi]

The declarative <all_urls> + document_start content script runs the rrweb bundle on every page the user ever visits, even when idle. Registering it dynamically when recording starts (chrome.scripting.registerContentScripts / executeScript with injectImmediately — https://developer.chrome.com/docs/extensions/reference/api/scripting#method-registerContentScripts) means:

• materially better Chrome Web Store review odds (the debugger + <all_urls> combo triggers in-depth review)
• smaller install warning
• zero overhead on non-recorded pages

activeTab + scripting are already in the manifest. The e2e suite (e2e/extension.spec.mjs) should pass unchanged — it asserts behavior, not injection mechanics.

[SaintPepsi]

Why this matters most: the install warning

The <all_urls> + document_start content script is what makes Chrome show "Read and change all your data on all websites" at install — the recorder runs on every page, always, even when idle. That prompt is a real adoption blocker: a tester paused on exactly this warning before adding the extension.

Injecting the recorder at record time (chrome.scripting, using the existing activeTab + scripting permissions — no new permissions) means OpenJam touches a page only when the user hits record. That:

• shrinks the install warning — the single biggest trust signal a new user sees;
• reinforces the privacy promise (nothing runs until you choose to record);
• smooths future CWS/Edge reviews (the debugger + <all_urls> combo triggers the slow in-depth review).

Bumped to priority: high — this addresses the permission prompt that actually gives real users pause.

Verify: the e2e suite asserts behaviour, not injection mechanics, so it should pass unchanged — that's the regression check.