console: agent-first mode (console plan / console verify), verified App Privacy and Play Create app facts

- `storebound console plan <form> [--json] [--lookup]`: read-only plan for an AI agent that drives the browser
  itself: start URL (deep links), ordered steps, answer sheet with the console's exact labels (certain / ask owner,
  curly quotes noted), never-press list, verified UI facts, driving guidance (in-page async loop + window.__log),
  verify instructions. All six forms.
- `storebound console verify <form> [--from-text <file|->]`: App Privacy per-type summaries from page text, Play
  Create app from input states, content rating / target audience summaries, App Store record and age rating from
  the API; exit 1 on a mismatch.
- MCP: console_plan, console_verify (read-only); console fill stays off MCP.
- App Privacy (verified 2026-10-12): two information steps, unlabeled purpose checkboxes (nearest parent text),
  "Definitions and Examples" never pressed; fixture and engine follow.
- Play Create app (verified 2026-10-12): /developers/<id>/create-new-app, App package name + read-only Check
  availability, material-radio inner [role=radio] click, app dashboard URL and play.appId, service account
  "Add app" as an owner step.
- console-autofill skill rewritten agent-first; agents-core rule 10; README; pitfalls 12, 18 (confirmed sign-out),
  19; CHANGELOG; play-first-release.

README.md

@@ -485,7 +485,14 @@ a terminal first and are never offered over MCP.
 - **RevenueCat (optional):** `storebound revenuecat diff | sync` mirrors products, subscriptions, entitlements and a
   default offering into a RevenueCat project (REST API v2, secret key from env / `.storebound/`). sync only creates and
   attaches, never deletes. Runtime entitlements, receipts and paywalls stay RevenueCat's job. Skill: `revenuecat-sync`.
-- **Console autofill for forms without an API:** `storebound console fill <form>` (`apple-app-record`,
+- **Console forms without an API, agent-first:** `storebound console plan <form> [--json]` gives your AI agent the
+  start URL (deep links when the ids are known), the steps, the answer sheet from the config (each answer certain or
+  "ask owner", with the console's exact labels), the buttons it must never press and the UI facts verified on the real
+  consoles; the agent drives the page with its own browser tool (Claude in Chrome, a built-in browser, Playwright),
+  stops before the final button and tells you what to press. `storebound console verify <form> [--from-text -]` then
+  checks the page against the config (App Privacy per-type summaries, Play Create app input states, summaries, or the
+  App Store Connect API) and exits 1 on a mismatch. Both are read-only MCP tools (`console_plan`, `console_verify`).
+- **Scripted fast path:** `storebound console fill <form>` (`apple-app-record`,
   `apple-age-rating`, `apple-app-privacy`, `play-app-record`, `play-content-rating`, `play-target-audience`) opens a
   visible browser, goes to the form by itself (Apps > + > New App, the app's App Privacy, Play All apps > Create app,
   Play app list > App content > Start / Manage;
@@ -508,8 +515,11 @@ a terminal first and are never offered over MCP.
   with several accounts and none set it stops and lists them. It fills App name (`play.name` or `app.name`, 30
   characters), Default language, App or game (the profile) and Free or paid (`play.free`, else Free for IAP / ads:
   an owner check, a free app can never become paid). It never ticks the Developer Program Policies or US export laws
-  declarations and never presses the form's Create app: you do. The package name is set by the first AAB upload
-  (`storebound play upload --track internal` or `storebound flow run release`).
+  declarations and never presses the form's Create app: you do. With `play.developerId` it opens the form's own URL
+  (`/console/u/0/developers/<id>/create-new-app`); it fills App package name from `play.packageName` and presses the
+  read-only "Check availability", and clicks the inner `[role=radio]` of Play's material radios (the native input
+  does not update the form). After Create app, add the new app to your service account yourself (Users and
+  permissions > the service account > Add app): app-level permissions do not cover apps created later.
   When a page has changed it falls back to step-by-step guidance with copyable answers. **Console pages change; this is AI-assisted: review every field and save it yourself.** Desktop: "Fill in
   console" on the App info tab. Never over MCP. Skill: `console-autofill`.