Import browser agent bundles with scoped principal

[chubes4]

Summary

• Adds a non-secret import_principal contract for browser Playground agent bundles.
• Uses that principal to set Data Machine agent execution context only around datamachine/import-agent calls in the browser runner.
• Preserves the principal through browser session/task payload normalization and updates smoke coverage for the generated runner.

Testing

• php -l packages/wordpress-plugin/src/trait-wp-codebox-abilities-browser-runner.php && php -l packages/wordpress-plugin/src/trait-wp-codebox-abilities-inheritance.php && php -l packages/wordpress-plugin/src/class-wp-codebox-task-input-contract.php && php -l packages/wordpress-plugin/src/class-wp-codebox-agent-sandbox-runner.php && php -l tests/smoke-wordpress-plugin.php
• npm run wordpress-plugin-smoke
• npm run build
• git diff --check

Notes

• homeboy lint --path "/Users/chubes/Developer/wp-codebox@fix-browser-agent-bundle-import-principal" --extension nodejs failed in lab setup before linting the change because the offloaded workspace could not resolve node_modules/typescript/bin/tsc. The same npm run build command passed locally in this worktree.

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode (GPT-5.5)
• Used for: Drafting the scoped import-principal implementation, updating smoke coverage, running verification, and preparing the PR description for Chris to review.