feat(browser): execute client page commands locally

[Jinwoo-H]

	Files	Added	Deleted	Net
Test	3	+741	0	+741
Prod	8	+649	−61	+588

Summary

• Add an inert Electron-main executor for bounded client-hosted create and navigate commands.
• Retain and verify the exact execution-host route before preparing the route/profile partition.
• Mount blank on one current renderer, capture an immutable main-owned guest-incarnation claim, register the exact WebContents, grant navigation separately, and load only normalized HTTP(S).
• Fence cleanup and replacement until exact destruction is observed; preserve spontaneous-destruction proof without a global tombstone cache or WebContents-ID reuse hazard.

Why this stage

Draft PR #14558 composes the authenticated browser-host lease and bounded command dispatcher but intentionally has no Electron page handler. This stage supplies that handler behind an unregistered, production-inert boundary. It does not advertise a capability, register a runtime method, select client placement, or change current server/offscreen behavior.

The pinned T3Code reference at 184d8ef33b8f42869fb84f66a33984185b81dc47 uses the same useful lifecycle shape: logical preview state remains shared, Electron main tracks the exact guest WebContents, and navigation waits for guest registration. Orca additionally binds execution-host routes, remote DNS, route/profile partitions, authenticated generations, and fail-closed cleanup.

Causal evidence

On parent 357ccae07c, the executor module, exact navigateGuest path, and exact unregistered-guest retirement path did not exist, so the new oracle was deterministically red. During review, additional probes reproduced early route release after renderer failure, ambiguous-mount leakage, failed-create readmission, discarded destruction proof, proof-cache eviction, WebContents-ID reuse, and stale navigation targeting a replacement.

The candidate keeps active, creating, and failed page IDs under one 256-page cap. Each observed guest carries an immutable opaque incarnation claim and its own destruction promise. Retirement and navigation require that claim; Session and route release require its destruction proof. Ambiguous outcomes remain fenced instead of falling back or being retried silently.

Compatibility

This changes no exchanged field, stream opcode, RPC registration, published session content, persisted schema, dependency, lockfile, native module, renderer surface, or placement default. Older clients and runtimes continue current server-hosted/offscreen behavior. browser.screencast.v1, mobile/web behavior, SSH/WSL routing, folder workspaces, git worktrees, and explicit server placement are untouched. Normal non-route browser guests retain existing behavior.

Validation

• Reliability oracle: 5 files / 152 tests passed.
• Browser and paired-route package: 61 files / 837 tests passed.
• Full Vitest suite: 4,900 files / 52,536 tests passed, 121 intentional skips.
• The first loaded run hit the existing 30-second ceiling in two cwd-repair tests; both passed 2/2 in isolation and in the full rerun with a 120-second per-test ceiling.
• Cross-version terminal wire: 5/5 passed.
• Full node, CLI, and web typecheck passed.
• Native and type-aware zero-warning audits, changed-code quality, reliability manifest, max-lines ratchet, formatting, and diff checks passed.
• CLI build/artifact verification passed; Electron 43.1.0 and Playwright 1.59.1 are installed and runnable.
• Fresh correctness, lifecycle, and security/performance probes drove the claim, cleanup, capacity, and ID-reuse fixes above.

Remaining activation blockers

• Wire the executor to the authenticated lease lifecycle and a trusted renderer mount registry.
• Add capability-qualified production registration without changing legacy or server placement.
• Add authenticated reconciliation and bounded force-close recovery for failed/ambiguous creates before any reserved slot can be recovered.
• Prove real Electron attach/navigation/worker/popup/request containment with Playwright CDP.
• Prove headed, headless, and browserless paired-runtime behavior, crash/reload/reconnect inventory, and physical macOS/Linux/Windows, SSH, and WSL coverage.
• Keep default client placement and live migration disabled until those gates pass.

STA-4150

Stacked on #14558. Do not merge.