Restore agent access to authenticated previews

[mrubens]

Summary

• expose each authenticated shareable preview as ROOMOTE_<NAME>_PREVIEW_URL, including ports that ultimately redirect to a direct machine URL
• seed the task-scoped bypass cookie for both ROOMOTE_*_HOST and ROOMOTE_*_PREVIEW_URL domains before agent-browser navigation
• mint bypass credentials for authenticated unproxied preview entrypoints as well as proxied ports
• tell agents to use the dedicated preview URL when validating proxy, redirect, cookie, or hostname behavior
• keep bypass values out of generated instructions

Why

For an unproxied port, ROOMOTE_<NAME>_HOST intentionally points at the direct machine domain, while the human-facing Live Preview first enters through an authenticated preview-proxy domain. The browser wrapper previously seeded only the direct host. The credential was present, but its cookie was scoped to the wrong domain, so opening the shareable URL redirected the agent to Roomote sign-in.

This preserves the existing direct-host contract while separately exposing and authenticating the shareable preview entrypoint.

Validation

• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/worker exec vitest run src/commands/__tests__/utils.test.ts src/run-task/__tests__/sandbox-instruction.test.ts src/commands/setup/__tests__/legacy-runtime-tools.test.ts
• pnpm exec dotenvx run -f .env.test -- pnpm --filter @roomote/controller exec vitest run src/__tests__/utils.test.ts
• pnpm --filter @roomote/worker check-types
• pnpm --filter @roomote/controller check-types
• worker and controller package lint
• bash -n .docker/sandbox/install-browser-agent.sh
• pre-push checks: oxlint, residual lint, fast typecheck, and knip

[roomote-community]

No new code issues found. See task

• apps/worker/src/run-task/sandbox-instruction.ts:242 The new reachability guidance is incorrect for HTTP preview proxies because the wrapper only seeds secure bypass cookies.
• packages/types/src/environment-config.ts:731 Preview-repair guidance still uses ROOMOTE_<PORT_NAME>_HOST, which bypasses the proxy for unproxied ports.

_{Reviewed 0a6353d}