fix(container): keep the browser env alive where image ENV is dropped

[devin-ai-integration]

Summary

The AGENT_BROWSER_* settings in this image are ENV lines, which some sandbox
runtimes never deliver to the guest: they build their own rootfs from the image
filesystem and boot their own init, so the image's ENV is simply absent. In a
running sandbox of that kind:

$ env | grep AGENT_BROWSER      # nothing
$ cat /proc/1/environ           # nothing

Everything configured here is silently inert there — the idle timeout that
reclaims abandoned browsers, the automation-hardening flags in
AGENT_BROWSER_ARGS, the user agent, the screenshot dir.

Agent commands do run through a login shell, so the values are additionally
emitted as a profile script, generated at build time from the ENV lines so
there is still one source of truth:

# /etc/profile.d/agent-browser.sh
export AGENT_BROWSER_IDLE_TIMEOUT_MS="${AGENT_BROWSER_IDLE_TIMEOUT_MS:-180000}"
...

Each entry keeps the :- fallback, so an explicitly-passed value still wins and
plain docker run -e ... behaves exactly as before. The build asserts the result
under env -i bash -lc, i.e. with the environment emptied the way such a runtime
empties it.

Verified end to end in a real sandbox built from this image: before, the timeout
and args were UNSET in both a plain command and a detached setsid child;
after, both report 180000 and the full arg list, an abandoned browser session
is reclaimed at 180s (22 → 11 Chromium processes, 751 → 543 MB) while a session
touched every 45s survives, and the reclaimed one relaunches on its next command.

Link to Devin session: https://app.devin.ai/sessions/dad023e379e942f287bcf6822463b7a4
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

Adds a login-shell profile fallback so browser configuration remains available in sandbox runtimes that discard Docker image environment metadata.

• Generates /etc/profile.d/agent-browser.sh from the existing AGENT_BROWSER_* image defaults.
• Preserves nonempty runtime overrides through shell parameter expansion.
• Adds a clean-environment build assertion for the idle-timeout fallback.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issue identified.

The generated profile supplies the intended browser defaults when image environment metadata is absent while retaining nonempty runtime overrides, and the changed build step validates the primary fallback.

Important Files Changed

Filename	Overview
containers/Dockerfile	Adds profile-based browser environment defaults and a build-time login-shell assertion; no concrete changed-code defect was established.

_{Reviews (1): Last reviewed commit: "fix(container): keep the browser env ali..." | Re-trigger Greptile}