feat(agent): implement CDP port exposure mode (ADR 0004)

cmd/passless/src/agent/audit_events.rs

@@ -531,6 +531,8 @@ pub struct BrowserLeaseLaunchMeta {
     lease_id: BrowserLeaseId,
     profile_id: ProfileId,
     endpoint_id: EndpointId,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    cdp_expose: Option<String>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -1161,6 +1163,7 @@ pub struct BrowserLeaseLaunchBuilder {
     lease_id: BrowserLeaseId,
     profile_id: ProfileId,
     endpoint_id: EndpointId,
+    cdp_expose: Option<String>,
 }
 
 impl BrowserLeaseLaunchBuilder {
@@ -1169,14 +1172,21 @@ impl BrowserLeaseLaunchBuilder {
             lease_id,
             profile_id,
             endpoint_id,
+            cdp_expose: None,
         }
     }
 
+    pub fn with_cdp_expose(mut self, mode: String) -> Self {
+        self.cdp_expose = Some(mode);
+        self
+    }
+
     pub fn build(self) -> AuditEvent {
         AuditEvent::new(AuditPayload::BrowserLeaseLaunch(BrowserLeaseLaunchMeta {
             lease_id: self.lease_id,
             profile_id: self.profile_id,
             endpoint_id: self.endpoint_id,
+            cdp_expose: self.cdp_expose,
         }))
     }
 }