[Security] Isolate browser pages, storage, fallback, and input by agent session

[fettpl]

Summary

• Requires one canonical x-local-studio-browser-session key on every stateful browser verb, frame, state, input, and viewport request, while keeping /fetch and /localhosts stateless.
• Gives each validated key its own Chromium browser context, page, fallback state, polling/input state, last-access timestamp, and bounded lifecycle.
• Wires the focused agent session through the visible browser store, screencast/input transport, Pi browser extensions, and serialized runtime creation; focus changes abort stale traffic instead of falling back to a shared page.
• Adds Schema-validated capacity and idle-TTL configuration, serialized creation, LRU idle eviction, all-active refusal, idempotent release, and shutdown cleanup without evicting in-flight work.
• Holds fallback navigation/reading work under one per-session lease and ordering lock so release, TTL cleanup, capacity pressure, or a stale completion cannot destroy or overwrite active session state.
• Uses a discriminated session-parse result rather than realm-sensitive instanceof Response, ensuring the compiled standalone and packaged app return 400 for missing, empty, malformed, or body-conflicting keys before host side effects.

Closes #237

Depends on #254, which supplies the single protected browser surface this branch isolates.

Validation

• Exact reviewed head: c6cfe1279ac4622a852ca7ff848a70d834a42aed.
• Current-head Actions are awaiting upstream approval: CI and Security.
• Independent P0/P1 review approved the exact refreshed head with no blocking findings.
• Focused browser transport/UI suites: 20/20 passed.
• Full frontend suite: 55/55 passed.
• Controller suite: 19/19 passed.
• Runtime and integration suite: 46/46 passed.
• npm run check: passed across contracts, structure, frontend quality/tests/build, controller gates, and the standalone regression.
• The normal pre-push hook reran frontend lint, frontend/desktop typechecks, cycle/UI/dead-code/duplication/dependency checks, focused frontend tests, and the production build; all passed.
• npm --prefix frontend run desktop:dist: passed. Local signing was skipped because no trusted matching signing identity is installed; ZIP and DMG artifacts were otherwise built successfully.
• The canonical /Applications/Local Studio.app was cleanly replaced and relaunched; /api/desktop-health returned HTTP 200 with {"ok":true}.
• Packaged boundary smoke returned HTTP 400 when the session header was absent, HTTP 400 when a conflicting body sessionId was supplied, and HTTP 400 for a malformed key.
• Packaged real-Chromium isolation smoke navigated two session contexts independently. Session A and B retained distinct URLs and frames; changing A to a second URL left B unchanged. Both frames were independently readable at 19,176 bytes.

Configuration and lifecycle

• LOCAL_STUDIO_BROWSER_MAX_SESSIONS: default 8, accepted integer range 1..32.
• LOCAL_STUDIO_BROWSER_SESSION_IDLE_MS: default 900000, accepted integer range 60000..86400000.
• Invalid explicit values fail Schema decoding instead of being clamped.
• Idle cleanup and capacity eviction skip active records; release waits for in-flight work and is idempotent.

Risks / rollout notes

• The session key is an isolation key, not authentication; existing route-access controls remain in force.
• One managed Chrome process hosts separate browser contexts. Cookies, storage, page state, fallback navigation, input, and cleanup are isolated per session without multiplying OS browser processes.
• Fork-originated CI and Security workflows require upstream maintainer approval before they can execute.