fix(*): key browser grants on the page a call lands on and prune owner state

[LivXue]

Summary

Fixes the three defects #600 reports in the browser tools, and the test
fixture that failed six real-browser tests on Linux.

A permission key could name a site the call would not act on. The
acting tools write the site into the call before the gate reads it, and
took it from url_for(owner), which fell back to the front tab for an
owner with no live binding. When another owner held that tab, the call
opened a blank tab of its own instead: a person approved bank.test for
a key press that landed on about:blank, and banked a grant that any
later click, type or press on bank.test presents, since the three
verbs share one key per site.

url_for now reports the page _page_for will bind, through one rule
both use (_landing): the owner's live tab, else the front tab unless
another live owner holds it, else nothing. In the last case the call
opens a tab of its own, which no site describes yet, so no site is
written and the grant is keyed on the call itself.

The issue offered two directions, and neither is taken as written. An
empty answer for every unbound owner fixes the reported case but breaks
one that worked: with the front tab the reader's own, the call lands on
it while the prompt names no site, and its per-call grant can then be
presented by an identical call on whatever front tab comes next.
Resolving the site after binding would make cast_params asynchronous,
and that hook is part of the contract every tool shares.

_BrowserTool._acted was never pruned. Keyed by run:<uid>, it
kept one entry per delegated run for the life of the process: 50,000
runs left 50,000 entries and 6.6 MiB after gc.collect(). The driver
now ends every binding through one _drop_owners (a reap, a release,
the owner's tab closing, the browser closing) and tells a listener the
tools register on their first stamp. The map also keeps only the 512
owners that acted most recently, for owners whose binding is never
dropped. The same 50,000 runs now leave 512 entries.

browser_tabs did not say that close refuses a tab nobody holds.
Such a tab is the user's and may hold a login they were asked to
finish, and the listing marks it neither yours nor held. The
description now says so, as does the browser guide in both languages.

test_browser_real_web.py aimed Playwright at the macOS cache on
every platform. The suite redirects HOME, and Playwright resolves
its cache from the home directory, so the fixture points it back at the
login's cache, but only at ~/Library/Caches. The look-up now lives in
tests/_browser_cache.py, shared by both real-browser suites, and
mirrors playwright-core's registryDirectory: XDG_CACHE_HOME on Linux,
LOCALAPPDATA on Windows, PLAYWRIGHT_BROWSERS_PATH=0 for an install
inside the package, and a relative path. Both suites skipped only when
the package was missing, so a missing browser failed them; they now
check for the browser. The driver called that failure "not installed"
even when the browser sat where the process did not look; the message
now quotes the path it looked for and names PLAYWRIGHT_BROWSERS_PATH,
on one line.

Known gaps, left as they are:

• url_for is a prediction made before the prompt. Anything that moves
  while a person decides (the reader switches tabs, another owner takes
  the front tab, the binding idles past ten minutes) moves the call with
  it. Closing that needs the gate to see the binding the call will use;
  the issue thread sketches one shape.
• The skip checks for a Chromium directory, not the revision this
  Playwright needs. A cache holding only an older build still fails the
  launch, and the message then names the path it looked for.
• browser_tabs stamps an owner after closing that owner's own tab;
  that stamp leaves through the cap rather than through a release.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

Run with the project environment's interpreter (all extras installed):

• python -m pytest over tests/test_browser_cache.py,
  tests/test_browser_driver.py, tests/test_browser_tools.py,
  tests/test_browser_policy.py,
  tests/integration/test_browser_real_web.py and
  tests/integration/test_browser_tools_real_web.py: 172 passed. CI
  does not collect tests/integration/, so those two files ran here
  only.
  With PLAYWRIGHT_BROWSERS_PATH pointed at a directory that does not
  exist, all 12 skip with the new reason instead of failing.

• The url_for table, one case per branch of the landing rule, fails
  against main in the two cases where another owner holds the front
  tab, and against the empty-answer direction in the three where the
  front tab is free.

• Deleting each of the 22 constructs that carry this change, one at a
  time, turns at least one test red.

• python -m pytest -q -p no:randomly: 27132 passed, 7 failed, 116
  skipped. The same 7 IDs fail on a complete tree of origin/main: five
  provider-proxy tests that read this machine's proxy settings, and two
  Node-runtime tests that depend on its node install and on root
  ignoring permission bits.

• ruff check and ruff format --check on the changed files,
  lint-imports (10 kept, 0 broken), and ty check raven evolver agents plugins-dist scripts (the make lint-types set): all pass.

• scripts/check_source_language.py and scripts/check_large_files.py
  over origin/main...HEAD, and scripts/check_commit_messages.py and
  commitlint over origin/main..HEAD: all pass.

• Relevant tests pass locally

• Relevant lint / type checks pass locally

• User-facing docs or screenshots are updated when needed

Risk

An acting call that would open a tab of its own is no longer keyed on
the front tab's site: its prompt names no site, and a session grant for
it covers only an identical call, so that state prompts more often. A
call landing on the user's front tab keeps the site key it had. The
browser-unavailable message the panel shows is reworded; nothing parses
it. No config, schema or stored state changes, and reverting the squash
commit restores the previous behaviour.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

Fixes #600

[gloryfromca]

No blockers; this can merge as far as I am concerned.

I reviewed the refreshed github/main...HEAD diff and found no plain error. I covered the repository rules in AGENTS.md and the Browser/Permission Gate vocabulary and layer constraints in CONTEXT-MAP.md/CONTEXT.md; the full diff; the permission-key, browser-owner, tab, relaunch, and approval callers; the relevant history; backward compatibility; and whether tests were removed or weakened. The shared landing rule keeps url_for aligned with _page_for, owner removal reaches the external stamp state on each binding-ending path, and the test changes add coverage rather than relaxing existing assertions.

Verification:

• uv run pytest tests/test_browser_cache.py tests/test_browser_driver.py tests/test_browser_tools.py tests/test_browser_policy.py - 160 passed.
• The same run plus both real-web suites - 160 passed, 12 failed because the cached Chromium on this host cannot load libatk-1.0.so.0; the failures occur at browser launch, before the reviewed behavior.
• uv run ruff check ... - passed.
• uv run ruff format --check ... - 9 files already formatted.
• uv run python scripts/check_source_language.py github/main...HEAD - passed.
• git diff --check github/main...HEAD - passed.