Fix frame locate tripping the signed-out guard

A frame-targeted step resolved the element inside the checkout iframe and
reported that iframe's URL as the result `url`. The signed-out guard keys off
`url` to decide whether the tab is on the login page, and Lucid's checkout
iframe sits on the apex host (lucidtrading.com) that its signedOutPattern
matches — so a signed-in checkout looked signed out, ran the login step, and
failed with no login button present.

Report the TOP tab's URL as `url` (from pageFrameOffset), keeping the child
frame's URL as `frameUrl`. Extension 0.14.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/automations.ts

@@ -19,7 +19,7 @@ export type AutomationStep =
     // WooCommerce checkout modal). Its value is a selector for the <iframe>
     // element in the top document; the step's own `selector` is then resolved
     // inside that frame and its coordinates offset back to the page. Without it a
-    // selector only ever matches the top document. Needs extension 0.13.0+ and
+    // selector only ever matches the top document. Needs extension 0.14.0+ and
     // runner 0.19.0+.
     | { action: 'click'; selector: string; index?: number; skipIfNotFound?: boolean; urlPattern?: string; frame?: string; label?: string }
     | { action: 'type'; selector: string; text: string; index?: number; clear?: boolean; skipIfNotFound?: boolean; urlPattern?: string; frame?: string; label?: string }