Replace the agentic browser fleet's Chromium engine with CloakBrowser

[minhtrinh-imbue]

Summary

• The agentic browser fleet (libs/browser) now drives CloakBrowser -- a from-source C++ (Blink/V8) stealth-patched Chromium fork -- instead of Playwright's own managed Chromium. session.py's LiveBrowser.start now points browser_use.BrowserSession(executable_path=...) at a fixed /opt/cloakbrowser/chrome instead of playwright.chromium.executable_path.
• scripts/deferred_install.sh no longer downloads Playwright's Chromium at all: playwright install-deps chromium still runs (apt shared libs only), then a pinned, SHA256-verified, per-arch (Linux x64/arm64) CloakBrowser release is curl'd + unpacked to /opt/cloakbrowser/. Two done-markers now (done.playwright_deps, done.cloakbrowser) instead of one.
• CloakBrowser becomes the only Chromium binary in the image -- an agent's own direct Playwright calls (from playwright.sync_api import sync_playwright) also need to pass executable_path="/opt/cloakbrowser/chrome" explicitly now, since Playwright's own browser-cache autodiscovery only finds builds it downloaded itself. CLAUDE.md's browser-automation guidance is updated accordingly (this branch predates the AGENTS.md split in flight on add-codex, so the edit landed in CLAUDE.md directly, matching current main).
• Companion cloud-side change: Bake CloakBrowser instead of vanilla Chromium in the cloud slice pre-bake mngr#2520 (the cloud slice pre-bake needs the same swap so loaded slices skip the deferred install correctly).

Why CloakBrowser and not Fortress

Considered tiliondev/fortress first (same class of tool -- C++-engine-level stealth patches, not JS/CDP-layer). Ruled it out: it ships no Linux arm64 build (native binaries are Linux x64 + Windows x64 only; their own roadmap lists linux/arm64 as unshipped), which would break the desktop/Lima path on Apple Silicon. CloakBrowser publishes real cloakbrowser-linux-arm64.tar.gz release assets (verified directly against their GitHub releases API) and a genuinely multi-arch Docker image (amd64+arm64, verified via Docker Hub's API), covering both the desktop (arm64) and cloud (amd64) paths with one engine. Tradeoff: CloakBrowser's free tier trails their paid tier by ~1-2 Chromium majors (~6-10 weeks); accepted per discussion.

Test plan

• libs/browser/browser_test.py -- full suite passes (64/64), including test_deferred_install_ready_gates_on_marker
• libs/browser/test_browser_integration.py::test_http_new_browser_blocked_until_chromium_installed -- passes
• bash -n scripts/deferred_install.sh -- valid syntax
• Verified in an isolated worktree off latest main, dependencies fully synced
• Downloaded and inspected the actual pinned CloakBrowser release tarball (chromium-v146.0.7680.177.4, linux-arm64) to confirm the real binary path (chrome, unbranded, flat archive) rather than assuming it
• Not run: an actual container boot exercising deferred_install.sh end-to-end (curl/tar/sha256 in a real gVisor/Lima container), and a real fleet browser launch against the CloakBrowser binary

🤖 Generated with Claude Code

[minhtrinh-imbue]

Superseded — switching to a native arm64 build of Fortress (tiliondev/fortress#28 + https://github.com/MT-GoCode/fortress/releases/tag/linux-arm64-151.0.7908.0), stronger stealth engine with no free-tier version staleness. CloakBrowser was the fallback while Fortress had no arm64 build; that's resolved now. No work lost, just not the direction going forward.