fix: repair sandbox browser driver lifecycle - #186

Summary

• Fixes browser initialization that was blocked by the driver's own global provider-fetch restriction.
• Gives the driver explicit ownership of Chromium so startup failures and shutdowns cannot leak browser processes.
• Makes readiness represent a fully initialized Stagehand context and reduces stale-driver detection from 90 seconds to 5 seconds.
• Disables PTY echo before credentials are delivered over stdin so secrets cannot enter Daytona session logs.

Context

Production acceptance QA exposed this incident directly; there is no separate Linear issue or plan document.

Architecture

The browser driver now has two explicit transport boundaries:

1. A provider-scoped, response-bounded fetch implementation injected into Stagehand's AI SDK client.
2. Native loopback CDP transport whose WebSocket endpoint is fetched with a byte limit and validated against the exact owned Chromium port.

The driver launches Chromium itself, attaches Stagehand through the validated CDP URL, and retains the launch handle for deterministic cleanup. The readiness endpoint returns success only after Stagehand and the browser connection guard are installed.

Decisions Made

Edge Cases Handled

How to Review

1. Start with infra/containers/sandbox/browser-driver/server.js for transport ownership, readiness, and cleanup.
2. Review infra/containers/sandbox/scripts/start-browser-driver.sh for the credential-delivery boundary.
3. Review packages/agent-core/src/tools/browser/actions.ts for stale-driver detection.
4. Confirm the lock and sandbox README match the implementation.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• node --check infra/containers/sandbox/browser-driver/server.js
• git diff --check
• Protected immutable sandbox snapshot build
• Promote the reviewed snapshot in the agent-worker configuration
• Repeat the production Pomodoro build and browser verification flow
• Confirm bootstrap credentials are absent from the new Daytona session log
• Confirm driver termination leaves no owned Chromium process