[Security] Isolate browser pages, storage, fallback, and input by agent session

[fettpl]

Summary

• Requires one canonical x-local-studio-browser-session key on every stateful browser verb, frame, state, input, and viewport request, while keeping /fetch and /localhosts stateless.
• Gives each validated key its own Chromium browser context, page, fallback state, polling/input state, last-access timestamp, and bounded lifecycle.
• Wires the focused agent session through the visible browser store, screencast/input transport, Pi browser extensions, and serialized runtime creation; focus changes abort stale traffic instead of falling back to a shared page.
• Adds Schema-validated capacity and idle-TTL configuration, serialized creation, LRU idle eviction, all-active refusal, idempotent release, and shutdown cleanup without evicting in-flight work.
• Holds fallback navigation/reading work under one per-session lease and ordering lock so release, TTL cleanup, capacity pressure, or a stale completion cannot destroy or overwrite active session state.
• Uses a discriminated session-parse result rather than realm-sensitive instanceof Response, ensuring the compiled standalone and packaged app return 400 for missing, empty, or malformed keys before body parsing or host side effects.

Closes #237

Depends on #254, which supplies the single protected browser surface this branch isolates.

Validation

• Exact reviewed head: 0937de14dfd0ae7bdd61ddde42fc0d1ce60229c3.
• Current-head Actions are awaiting upstream approval: CI and Security.
• Independent P0/P1 review approved the complete commit and the final packaged-boundary delta with no blocking findings.
• Actual bundled-standalone invalid-session regression: 1/1 passed across all five stateful route classes, including malformed-body precedence and stateless-route controls.
• Focused runtime/session/fallback/host/Chromium suites: 36/36 passed in final independent review.
• Focused browser transport/UI suites: 20/20 passed in final independent review.
• Earlier full real-Chromium isolation suite: 3/3 passed, covering separate contexts, storage/history/viewport/input/screenshot/frame state.
• npm run test:integration: 53/53 passed.
• npm run check: passed across contracts, structure, frontend quality/tests/build, controller gates, and the new standalone regression.
• The normal pre-push hook reran frontend lint, frontend/desktop typechecks, cycle/UI/dead-code/duplication/dependency checks, 20/20 frontend tests, and the production build; all passed.
• npm --prefix frontend run desktop:dist: passed using the existing integrity-verified Electron 43.1.1 cache archive after the upstream CDN returned HTTP 503 twice. Local signing was skipped because no trusted matching signing identity is installed; ZIP and DMG artifacts were otherwise built successfully.
• The canonical /Applications/Local Studio.app was cleanly replaced and relaunched; /api/desktop-health returned HTTP 200 with {"ok":true}.
• Packaged missing-session smoke returned the required HTTP 400 and stable validation error.
• Packaged real-Chromium smoke used two contexts on one loopback origin: session A retained owner=A storage/cookie plus input=alpha; session B retained owner=B plus empty input. Neither observed the other's state.

Configuration and lifecycle

• LOCAL_STUDIO_BROWSER_MAX_SESSIONS: default 8, accepted integer range 1..32.
• LOCAL_STUDIO_BROWSER_SESSION_IDLE_MS: default 900000, accepted integer range 60000..86400000.
• Invalid explicit values fail Schema decoding instead of being clamped.
• Idle cleanup and capacity eviction skip active records; release waits for in-flight work and is idempotent.

Risks / rollout notes

• The session key is an isolation key, not authentication; existing route-access controls remain in force.
• One managed Chrome process hosts separate browser contexts. Cookies, storage, page state, fallback navigation, input, and cleanup are isolated per session without multiplying OS browser processes.
• Fork-originated CI and Security workflows may require upstream maintainer approval before they run.

[fettpl]

@0xSero CI and Security for the independently approved exact head 0937de14dfd0ae7bdd61ddde42fc0d1ce60229c3 are waiting for upstream workflow approval: CI and Security. This head passed the full repository gate, 53/53 integrations, independent P0/P1 review, production packaging/reinstall with health 200, the packaged 400 session-boundary regression, and a real two-context storage/cookie/input isolation smoke. Please approve the workflows and review when convenient.