Cloudflare checks failing with Harper enabled

**Describe the bug**

When the Harper browser extension is enabled on a page, Cloudflare Turnstile ("I am human" verification) consistently fails to complete, throwing `Security Check Failed — Error: 600010 (Unknown)`. This happens even though every local Turnstile diagnostic (automation check, system clock, browser API compatibility, connectivity) reports as passing. Disabling Harper — either via the popup's per-domain toggle or by fully disabling the extension — immediately resolves the issue and Turnstile completes successfully on retry.

**To Reproduce**

1. Have the Harper extension enabled/active on a domain (or set to run on all sites)
2. Visit a site using Cloudflare Turnstile — reproduced both on Cloudflare's own official troubleshooter at `https://browser-compat.turnstile.workers.dev/` and on unrelated third-party sites, so it isn't site-specific
3. Attempt to complete the Turnstile challenge
4. Verification fails repeatedly with error 600010, even after refreshing/retrying multiple times
5. Disable Harper for that domain and reload — verification now succeeds on the first attempt

**Expected behavior**

Harper's content script should not interfere with Cloudflare Turnstile's challenge/verification flow. Turnstile should complete normally whether or not Harper is active on the page.

**Screenshots**

**Platform**

Chrome Extension (installed on Vivaldi, a Chromium-based browser) — Windows 10/11, Chrome/150-compatible UA.

```
GET https://brunhild.challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/...
Status: 0 (request never reaches the network — no server IP, all timing phases 0/-1)
```

This request fails identically on every attempt while Harper is enabled, and succeeds once Harper is disabled for the domain. (For reference, separate `.../h/b/pat/...` requests returning 401 with a `PrivateToken` challenge header are normal/expected Private Access Token flow — not part of the bug, just noting them so they aren't mistaken for it.)

Given Harper requests "access your data for all websites" and injects a content script into every page (likely including cross-origin iframes, which is how Turnstile's widget is rendered), our working theory is that Harper's DOM scanning/mutation observing during page load is either interfering with the network call directly or triggering Cloudflare's bot-detection heuristics.

The report points to Harper's injected content script and its DOM scanning or mutation observing during page load, but names no source files or tests. Start by tracing the Chrome extension content-script entry point and reproducing the failure at the Cloudflare Turnstile troubleshooter; done means Turnstile succeeds with Harper enabled while the unrelated PrivateToken requests remain unaffected.

Written by the indexing model from the issue text.