a11y hack: --ocr opt-in + VisionWorker sentinel bridge (focusless)

a11y hack used to run CCA + UIA + OCR + Gemini Vision always. Heavy runs (every invocation) would fire CDP tab activation from the Vision worker and steal foreground. Now OCR/Vision are opt-in via --ocr; default path is CCA + UIA only. When --ocr is passed, VisionWorker's CDP call is bracketed with the main sentinel's Checkpoint so theft is caught immediately, not at end of pipeline.

Steps