Target.getTargetInfo: Not allowed crash on pages with cross-origin iframes

### FAQ

- [x] Yes, my issue is not about [variability](https://github.com/GoogleChrome/lighthouse/blob/main/docs/variability.md) or [throttling](https://github.com/GoogleChrome/lighthouse/blob/main/docs/throttling.md).
- [x] Yes, my issue is not about a specific accessibility audit (file with [axe-core](https://github.com/dequelabs/axe-core) instead).
- [x] Yes, my issue is not answered by [other FAQs](https://github.com/GoogleChrome/lighthouse#faq).

### URL

https://github.com/oppia/oppia/actions/runs/32341392689/job/96344195118

### What happened?

Lighthouse crashes with an unhandled rejection when auditing pages that embed multiple cross-origin iframes (e.g. Stripe, YouTube, third-party widgets):

```
Unhandled Rejection. Reason: Error: Protocol error (Target.getTargetInfo): Protocol error (Target.getTargetInfo): Not allowed
```

The error occurs in core/gather/driver/target-manager.js in the _onSessionAttached handler. When Lighthouse sets Target.setAutoAttach, Chrome auto-attaches to cross-origin iframes. For each attachment, Lighthouse calls Target.getTargetInfo to identify the target type. Chrome rejects this call with "Not allowed" for cross-origin targets in headless mode.

The [catch block at line 169 ](https://github.com/GoogleChrome/lighthouse/blob/9515cd4e58ebed69f78742d932b501c2cab8ad8f/core/gather/driver/target-manager.js#L169 )already handles `"Target closed"` and `"'Target.getTargetInfo' wasn't found"` gracefully, but does not handle `"Not allowed"`, so the error propagates as an unhandled rejection and crashes the Lighthouse process.

### What did you expect?

"Not allowed" should be caught and handled the same way as "Target closed", the cross-origin iframe is non-essential for Lighthouse audits and silently skipping it is safe, just like the existing error patterns.

### What have you tried?

- Verified the error reproduces consistently on pages with cross-origin iframes from multiple third-party origins (Stripe, Donorbox, YouTube).
- Confirmed the page works fine in regular Chrome (not headless) and in Chrome DevTools Lighthouse.
- Tried adding --disable-features=IsolateOrigins,site-per-process Chrome flags -- did not resolve the issue.
- Applied a local patch adding if (/Not allowed/.test(err.message)) return; to the catch block in target-manager.js -- this fixes the crash and Lighthouse completes successfully with accurate results.
- Found existing issue #15586 which was closed as "not planned" (attributed to puppeteer version mismatch), but our setup uses Lighthouse 12 with a compatible modern Chrome and the error persists.

### How were you running Lighthouse?

CLI

### Lighthouse Version

12.6.1

### Chrome Version

130+ (Chromium-based, headless=new mode)

### Node Version

20.11.1

### OS

Linux (Ubuntu, GitHub Actions CI)

### Relevant log output

```sh
Running Lighthouse checks for .lighthouserc.js.
OUTPUT:
✅ .lighthouseci/ directory writable
✅ Configuration file found
✅ Chrome installation found
⚠️ GitHub token not set
Healthcheck passed!

Running Lighthouse 3 time(s) on http://localhost:8181/donate
Run #1...failed!

Return code: 1
ERROR:
Error: Lighthouse failed with exit code 1
at ChildProcess. (/home/runner/work/oppia/oppia/node_modules/@lhci/cli/src/collect/node-runner.js:120:21)
at ChildProcess.emit (node:events:518:28)
at ChildProcess._handle.onexit (node:internal/child_process:294:12)
(node:5624) ExperimentalWarning: Importing JSON modules is an experimental feature and might change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
2026-08-20T07:23:01.754Z LH:ChromeLauncher Found existing Chrome already running using port 34021, using that.
2026-08-20T07:23:02.179Z LH:status Connecting to browser
2026-08-20T07:23:02.184Z LH:status Navigating to about:blank
2026-08-20T07:23:02.190Z LH:status Benchmarking machine
2026-08-20T07:23:03.194Z LH:status Preparing target for navigation mode
2026-08-20T07:23:03.203Z LH:status Cleaning origin data
2026-08-20T07:23:03.204Z LH:status Cleaning browser cache
2026-08-20T07:23:03.208Z LH:status Preparing network conditions
2026-08-20T07:23:03.226Z LH:status Navigating to http://localhost:8181/donate
2026-08-20T07:23:04.362Z LH:method <= browser ERR:error Target.getTargetInfo
Unhandled Rejection. Reason: Error: Protocol error (Target.getTargetInfo): Protocol error (Target.getTargetInfo): Not allowed

Lighthouse checks failed. More details can be found above.
```

The failure path is in core/gather/driver/target-manager.js, in the _onSessionAttached handler and its catch block around line 169. Start by reading that handler and the existing handling for “Target closed” and the missing-method error, then reproduce the issue with Lighthouse CLI on a page containing cross-origin iframes. Done means the rejection is handled without crashing and the audit completes.

Written by the indexing model from the issue text.