feat(browser): add native desktop Browser workspace

[oleksoleksoleks]

What this changes

• Adds the native desktop Browser workspace, including typed browser IPC, stable native surfaces, navigation, automation, capture, downloads, profiles, and crash recovery.
• Keeps surfaces isolated by owning OMP session and browser profile; authenticated profile mutations require explicit opt-in.
• Enforces navigation, popup, permission, download, certificate, proxy, and preload trust boundaries in the Electron main process.
• Makes pnpm dev build the desktop bundle, reserve a free renderer port, wait for Vite readiness, launch Electron with a validated loopback URL, and supervise both child processes.

How you verified it

• pnpm check — release consistency, provenance, lint, and typecheck passed against v0.1.29.
• pnpm test — all packages passed; desktop: 25 files / 155 tests, web: 74 files / 1086 tests.
• pnpm build — all workspace builds passed.
• Live desktop workflow — exact pnpm dev launched Electron on a dynamically selected renderer port and remained running.
• Live Browser workflow — opened a session Browser workspace, created a native tab, navigated to https://example.com/, and observed Example Domain in the Ready state.

Checklist

• pnpm check passes (release contract, provenance, lint, typecheck)
• pnpm test passes; new behavior has tests that fail without this change
• Any pasted logs or screenshots are redacted: no secrets, tokens, pairing codes, or private paths
• Ported code (T3 Code / OMP) follows the provenance rules in THIRD_PARTY_NOTICES.md

AI Review Report

Two independent reviews traced the complete change set across protocol, client, desktop runtime, preload, web workspace, and launcher. Review findings were remediated before push: page-initiated navigation guards, managed popup denial, shared-session permission lifetime, profile-session download routing, authenticated-profile reference counts and opt-in, OMP-session surface ownership, and per-surface screenshot state. Focused regressions were added for each corrected boundary.

Security Audit

The audit covered renderer-to-main IPC validation, native navigation and popup policy, profile isolation, permission routing, downloads and filename containment, proxy/auth/certificate handling, preload exposure, automation bounds, process spawning, and secret leakage. High-confidence findings were fixed before push; the final full check, test, and build gates passed.

[oleksoleksoleks]

@lyc-aon hey I need this pushed through ASAP -- high priority, blocking our team, and the stakeholders are angry. Need it done by 10PM EST tonight. Get your nerds on it.

Thanks!

[wolfiesch]

@lyc-aon hey I need this pushed through ASAP -- high priority, blocking our team, and the stakeholders are angry. Need it done by 10PM EST tonight. Get your nerds on it.

Thanks!

Thanks for the tightly scoped PR! I'm reviewing it now - will make sure it's included in the next T4 release (usually a couple hours)

[wolfiesch]

Made a few quick changes on top of this PR:

• Isolated browser state by OMP session.
• Scoped network rules and request logs to the correct tab.
• Prevented authenticated pages and popups from reopening without fresh consent.
• Disabled offline and proxy changes that could affect sibling tabs.
• Restored the Host Browser Preview security document and added a separate Native Browser document.
• Updated the branch to v0.1.30 and resolved the release-note conflict.

All required checks pass.

[oleksoleksoleks]

Thank you, you are Roy's greatest soldier.