feat: add browser-use template

[phala-agent]

Summary

Adds a Phala Cloud prebuilt template for browser-use/browser-use, implemented as a CPU-safe HTTP verifier for the real browser-use Python package.

Template files

• templates/prebuilt/browser-use/docker-compose.yml
• templates/prebuilt/browser-use/README.md
• templates/icons/browser-use.png
• templates/config.json entry: browser-use

Runtime shape

• Installs browser-use==0.12.9 by default via BROWSER_USE_VERSION.
• Exposes HTTP endpoints on port 8080:
  • GET /healthz
  • GET /demo
  • GET /v1/models
• Does not launch a browser, call an LLM provider, download model weights, use GPU, require credentials, use host bind mounts, use env_file, or require privileged/host networking.

Environment variables

• BROWSER_USE_VERSION (optional, default 0.12.9): Browser Use Python package version installed by the verifier service.

Icon source

• templates/icons/browser-use.png is copied from the upstream repository asset static/browser-use.png in browser-use/browser-use.

Validation

• python3 sdks/templates/validate.py ✅
  • Existing warnings only: unused mcp-jupyter.svg and maybe-finance.png.
• git -C sdks diff --check origin/main...HEAD ✅
• docker compose -f sdks/templates/prebuilt/browser-use/docker-compose.yml config >/tmp/browser-use-compose-config-postcommit.out ✅
• Static audit ✅
  • README coverage present.
  • Exactly one config entry with unique id browser-use.
  • Config repo points to https://github.com/Phala-Network/phala-cloud/tree/main/templates/prebuilt/browser-use.
  • Icon file exists and is non-empty.
  • Compose has no host bind mount, env_file, literal secrets, external build context, privileged mode, host network/ipc, or Docker socket mount.
• Image manifest check ✅
  • ghcr.io/astral-sh/uv:python3.12-bookworm-slim has a linux/amd64 manifest.

Phala Cloud deployment smoke

• Profile/workspace: hermes-admin-cvm-check / h4x's projects
• Instance type: tdx.small
• Deploy command used: phala deploy --profile hermes-admin-cvm-check --name auto-template-test-browser-use-0527-072547 --compose sdks/templates/prebuilt/browser-use/docker-compose.yml --instance-type tdx.small --wait --no-public-logs --no-public-sysinfo --json
• Smoke CVM / VM UUID: 699df849-def3-4e41-816d-034e72c07110
• App ID: a7e5a2ada2629255e4cf6305be27dd0e21d51567
• phala ps evidence: dstack-app-1 running with status Up ... (healthy) ✅
• Endpoint: https://a7e5a2ada2629255e4cf6305be27dd0e21d51567-8080.dstack-pha-prod7.phala.network
• HTTP probes ✅
  • GET /healthz returned 200 with browser_use.import_ok=true and version 0.12.9.
  • GET /demo returned 200 with browser_launched=false and llm_provider_calls=false.
  • GET /v1/models returned 200 with browser-use-local-verifier.

Cleanup

• phala cvms delete --profile hermes-admin-cvm-check 699df849-def3-4e41-816d-034e72c07110 --force --json ✅
• Follow-up lookup returned deleted/not found ✅

cc @Marvin-Cypher for review if the formal reviewer request does not attach.

[phala-agent]

cc @Marvin-Cypher for review.

[Marvin-Cypher]

Reviewed template files, normalized tags, compose config, config validation, stale path cleanup, and compose safety scan. Checks are passing.