feat: revive gh-attach for GHE React UI with session reuse

[atani]

Summary

Revives gh-attach (previously archived) to solve two recurring pain points:

1. SSO/SAML re-auth every few minutes. session-stop tore down the
   browser between every invocation, so session-only cookies (e.g. OneLogin
   "remember this device") died on exit. Add --session <name> +
   --keep-session so a single persistent playwright-cli session can
   serve many uploads. One login in the morning, rest of the day is free.
2. GHE React UI. Modern GHE replaces the classic file-attachment
   custom element with a React implementation. Direct mode does not work
   there because the custom element never appears. Fix Browser mode to
   work on GHE:
   • Read upload URL from textarea.value (not accessibility snapshot
     src attribute).
   • Re-fetch the drop-zone ref per image (refs are reissued on every
     snapshot).

Also adds --url-only: prints uploaded asset URLs to stdout and skips
comment creation/update so callers can post their own comment via
gh pr review --comment --body-file or similar.

Other fixes bundled in

• playwright-cli sandbox: daemon allowed_roots follows the parent
  shell's cwd. cd into the first image's parent so uploads work from
  any caller cwd.
• snapshot grep: case-insensitive [Snapshot] match.
• upload failure detection: use exit code plus File access denied /
  ENOENT strings, not a loose grep error that false-positives on
  "Console: N errors".
• grep -c → grep -o | wc -l: the textarea can hold multiple URLs on
  a single line.
• --session forces --persistent on open so the named session's
  on-disk user-data-dir is not silently replaced by an in-memory one.

README rewritten to reflect the new capabilities and drop the archive
notice.

Bumps VERSION to 0.7.0.

Test plan

Tested against a GHE instance (git.pepabo.com, React UI, behind OneLogin
SAML) on a closed test issue.

• Single image upload returns a user-attachments/assets/<uuid> URL
  to stdout and exits 0
• Multiple images upload in order and return one URL per line
• Consecutive invocations reuse the session without re-auth
• gh attach --help lists --session, --keep-session, --url-only
• bash -n bin/gh-attach passes syntax check
• Existing Browser/Release/Direct modes without the new flags keep
  their current behaviour on github.com (not regression-tested end to
  end in this branch; smoke-tested via help output and script structure)