Claude in Chrome MCP tool calls now re-check org policy at call time

Claude in Chrome MCP tool calls now check the allow_claude_browser_extension managed org policy at the moment a tool call is made, not just at install or upsell time. If the policy denies the extension, the call now throws "Claude in Chrome call refused by org policy" instead of proceeding.

The enforcement extends across the whole Chrome bridge: the /chrome settings command, the auto-enable path, and the startup dialog that offers to connect Claude in Chrome all now gate on this policy. The MCP server itself refuses to start when CLAUDE_CODE_CHROME_MCP_ORG_DENIED is set in its environment, exiting with cause parent_org_policy, and MCP connections that are blocked fail with errorCode POLICY_BLOCKED. The policy check defaults to denied until an org verdict is confirmed, and allow_claude_browser_extension has also been added to the HIPAA compliance-taint list, so HIPAA-restricted orgs block it by default. Where the policy can't be verified (third-party/custom base URL providers, missing claude.ai sign-in, or network errors), Claude Code now logs an explicit warning and relies on the extension itself to enforce the org setting.