Capture only settled, correctly sized browser screenshots

[hamzamerzic]

Problem

Authenticated screenshot automation could report success while keeping the wrong visual frame. Browser commands could split across daemon identities, navigation could replace the page after viewport setup, and DOM readiness could precede the compositor's useful paint. Shell handoffs also retain fully laid-out chat surfaces during opacity and mode transitions. A retained Chromium profile could additionally stay locked to a process from a previous container, preventing cold capture entirely.

Fix

• Add an inert, no-store same-origin bootstrap document for authentication and browser setup.
• Keep one browser daemon identity and bound individual commands with process-level timeouts and retries.
• Handle stable canonical shell redirects, detach stale service-worker ownership by default, and preserve cache only when explicitly requested.
• Make Shell publish one workspace visual-readiness contract based on the world it actually paints; the screenshot helper no longer scrapes private transition classes.
• Recover only stale singleton links in the per-chat automation profile after a container restart or browser crash, while preserving active and unfamiliar locks.
• Reapply the requested viewport immediately before every capture attempt and validate the kept PNG's IHDR dimensions.
• Prime the compositor, wait two renderer frames, and reject or retry tiny solid-background shell frames instead of accepting command success as visual evidence.
• Keep the token on stdin and verify authentication with a protected request at the final capture boundary.

Prior work

PR #59 hardened final-boundary screenshot authentication. PR #304 integrated the cold-start and freshness foundation. This follow-up preserves those contracts while closing the remaining daemon, final-viewport, shell-ownership, compositor, and retained-profile races exposed by live captures.

Verification

• Focused screenshot and browser-environment suite: 40 passed.
• Shell visual-readiness contract: 4 passed.
• Full frontend suite: 2,111 library/static checks and 66 hook checks passed.
• Production/PWA build passed with 3,008 modules and 45 precache entries.
• Authenticated live capture produced the requested 1,512×861 PNG with one settled chat surface; the served image returned 200 and the browser closed cleanly.
• The first public run's sole backend failure reproduced unchanged on the PR base and was fixed independently by green PR Keep the activity error-window test independent of wall-clock date #320; frontend, privacy, and end-to-end checks all passed on the submitted revision.