MV3 only runs content script "when clicked" for <all_urls>

[sublimator]

Does this mean that <all_urls> as a host permission is going away to be replaced by "activeTab" or does it mean that <all_urls> will still be permissible as a host permission but will not initially provide any access to the extension until the extension has been engaged with (ie. the "This can read and change site data" permission set to "When you click the extension")

The latter. In fact, the example you gave is spot on; new installs will basically have "when you click the extension" set by default, but users can choose to grant the ability to run everywhere or on specific sites if they wish.

[sublimator]

[sublimator]

This may not actually be true at this point. Chrome still seems to default to 'on all sites' for mv3 extensions, at least as loaded as an unpacked extension

[sublimator]

Looks like we are actually OK here!

[sublimator]

This actually seems like it WILL be a problem: https://github.com/w3c/webextensions/issues/227