doc: record the $-pattern and frame-focus corrections

The spec prescribed replaceAll's string form and the plan hard-coded it,
so the $-substitution defect originated in the design documents rather
than in execution. Both now specify the function replacer.

Also replaces the spec's frame-reporting idea with the document.hasFocus()
gate that shipped; frame provenance was only ever needed for auto-submit,
which Appendix B rejects.

docs/superpowers/plans/2026-07-30-extension-options-panel.md

@@ -486,7 +486,12 @@ function applyTemplate(template, query) {
   }
   const tpl = typeof template === "string" ? template : "";
   if (tpl.includes("{query}")) {
-    return tpl.replaceAll("{query}", query);
+    // Corrected during execution: the replacer MUST be a function. In the
+    // string form, $&, $`, $' and $$ are substitution patterns in the
+    // replacement — and the replacement is arbitrary page-selected text.
+    // Measured on the default {query} template: "awk print $& here" produced
+    // "awk print {query} here".
+    return tpl.replaceAll("{query}", () => query);
   }
   const trimmed = tpl.trim();
   return trimmed === "" ? query : `${trimmed} ${query}`;
@@ -704,7 +709,11 @@ async function readSelection() {
   let results;
   try {
     results = await browser.tabs.executeScript(tabId, {
-      code: "window.getSelection().toString()",
+      // Corrected during execution: gated on document.hasFocus(). Each frame
+      // owns an independent Selection that is not cleared when the user
+      // selects elsewhere, so an unfocused (possibly cross-origin) frame's
+      // stale selection could otherwise win on unspecified result ordering.
+      code: "document.hasFocus() ? window.getSelection().toString() : ''",
       allFrames: true,
       matchAboutBlank: true,
     });