type steps never trigger the confirmation gate

[royalpinto007]

Problem

The confirmation gate only checks click + write steps, so a recipe that types credentials or submits via type runs with no confirm: true check. Distinct from #3 (goto bypass).

Where

src/recipe.ts (hasWriteStep) + src/browser.ts (gate).

Acceptance

Add a failing test first showing hasWriteStep({steps: [{action: "type", ...}]}) returns true (or runRecipe refuses without confirm). Then fix.