Target the captcha widget the open modal is actually showing

Second reset still failed: token solved, callback reported as fired, confirm
button never enabled. The button enabling is pure client-side state — the
site's callback storing the token — so if it stays dark the LIVE callback
never ran, whatever was reported. Picking the newest client was still a guess.

There is a precise link. reCAPTCHA numbers its response fields by widget id:
the first widget gets #g-recaptcha-response, the second
#g-recaptcha-response-1. The field the open modal is showing therefore names
the client holding its callback. Use that, fall back to newest-first when
there is no id to go on.

The run log now prints which field carried the token and which widgets were on
the page, so the next failure is diagnosable from the log instead of by
hypothesis: `filled 1 response field(s) ['g-recaptcha-response-1'], fired
grecaptcha callback (widget 1)` / `page had widgets ['0','1'], live one looked
like 1`.

Also surfaces the extension version on the AutoBuyer page. The extension has
always stamped it into every capture and nothing ever read it, so the README's
claim that a version mismatch shows there was no way to check. Chrome runs the
old service worker until an unpacked extension is reloaded by hand, which is
exactly the state that makes a deployed fix look like a broken one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

clicker/captcha.py

@@ -152,10 +152,17 @@ def solve(dash, step, opts, report, cancelled=None) -> None:
     }, PAGE_TIMEOUT)
 
     called = delivered.get("called")
-    seen = delivered.get("candidates") or 0
+    fields = delivered.get("fieldIds") or []
+    keys = delivered.get("clientKeys") or []
     report(f"filled {delivered.get('filled', 0)} response field(s)"
-           + (f", fired {called}" if called else "")
-           + (f" — {seen} widgets on the page, used the newest" if seen > 1 else ""))
+           + (f" {fields}" if fields else "")
+           + (f", fired {called}" if called else ""))
+    # Printed whenever the page is carrying more than one widget, because that is
+    # the state in which handing the token to the wrong one is possible at all —
+    # and it looks identical to success right up until the button stays dark.
+    if len(keys) > 1 or (delivered.get("candidates") or 0) > 1:
+        report(f"page had widgets {keys or '?'}, live one looked like "
+               f"{delivered.get('liveWidgetId')}")
     if not called:
         # The token is in the form, so a plain submit still works — but a page
         # that gates its submit button on the callback will look unsolved, and