fix(browser): preserve user-live loopback attach guidance

[artemgetmann]

Review Fast Path

• User path fixed: Telegram/main Jarvis browser.open(profile=user-live) through loopback browser-control no longer reports generic gateway restart/no-retry when Chrome remote-debugging approval is the real blocker.
• Proof: pnpm exec vitest run src/browser/client-fetch.loopback-auth.test.ts src/agents/tools/browser-tool.test.ts -> 2 files / 59 tests passed; git diff --check passed.
• Shared-state footgun removed: loopback HTTP and in-process dispatcher now return the same user-live Chrome approval/setup guidance for timeout/abort failures.
• Still hurts: full Batik booking flow still needs shared-main/TUI proof after merge/restart; this PR does not change active-run lease behavior from fix(agent): renew active run timeout lease #805.

Why This Matters

• PR fix(browser): self-heal user-live Chrome attach #803 fixed self-healing attach behavior, but the live booking run hit an absolute loopback browser-control path and surfaced: Restart the OpenClaw gateway ... Do NOT retry the browser tool.
• That message is actively misleading for user-live: the user usually needs to approve Chrome remote debugging or enable it at chrome://inspect/#remote-debugging, not restart the gateway.

Scope Boundary

• Changed only browser-control error guidance for profile=user-live timeout/abort failures.
• Did not change browser auth, Chrome launch policy, debug-port selection, task leases, or durable timeout behavior.
• Separate from fix(agent): renew active run timeout lease #805.

Verification

• pnpm exec vitest run src/browser/client-fetch.loopback-auth.test.ts -> passed, 17 tests.
• pnpm exec vitest run src/agents/tools/browser-tool.test.ts -> passed, 42 tests.
• pnpm exec vitest run src/browser/client-fetch.loopback-auth.test.ts src/agents/tools/browser-tool.test.ts -> passed, 59 tests.
• git diff --check -> passed.

AI Assistance

• AI-assisted.
• Testing degree: targeted.