feat: add non-extension session parity

[freshtechbro]

Summary

OpenDevBrowser can now operate more reliably without the Chrome extension for owned browser/session continuity: explicit local CDP profiles have a first-class start/status/stop lifecycle, managed/direct sessions expose sanitized auth provenance, and provider workflows can distinguish browser state from actual auth proof before proceeding.

Google user-owned OAuth remains fail-closed to extension /ops, while managed/CDP cookie continuity stays diagnostic rather than login proof. Inspiredesign/Pinterest readiness remains product-authority based: transport success is not enough without the required artifact and evidence authority surfaces.

Review Notes

• RepoPrompt review loop passed after fixes in cdp-refactor-review-FFA9E4; no P0/P1/P2 blockers remained.
• Final refactor follow-up preserved BrowserManager.updateConfig() behavior, restored public mutable explicit-CDP types, and hardened process ownership/cleanup races.
• Known residuals: none accepted.

Verification

• npm run test -- tests/explicit-cdp-profile-helpers.test.ts
• npm run test -- tests/browser-manager.test.ts -t "explicit CDP profile"
• node scripts/run-package-tool.mjs eslint src/browser/explicit-cdp-profile-process.ts src/browser/explicit-cdp-profile-manager.ts tests/explicit-cdp-profile-helpers.test.ts tests/browser-manager.test.ts
• npm run typecheck
• git diff --check
• node scripts/generate-public-surface-manifest.mjs
• node scripts/docs-drift-check.mjs
• npm run version:check
• skills/opendevbrowser-best-practices/scripts/validate-skill-assets.sh
• npm run lint
• npm run build
• npm run extension:build
• npm run test passed with 302 test files passed, 1 skipped; 5,786 tests passed, 1 skipped; branch coverage 97.02%.
• node scripts/cli-smoke-test.mjs
• Real CLI smoke: isolated source-built daemon plus cdp-profile start/status, connect --profile --disable-system-cookie-bootstrap, disconnect, cdp-profile stop, and daemon stop all passed with sanitized provenance, no forbidden token/path/ws/cookie-value leaks, and no leftover process lines.

Post-Deploy Monitoring & Validation

• Watch daemon and CLI logs for cdp-profile start/status/stop failures, daemon_fingerprint_mismatch, stale lease warnings, and explicit-CDP process ownership cleanup warnings.
• Monitor support reports for profile lock failures, wrong-profile selection, missing sanitized profile summaries, or provider workflows proceeding despite doNotProceedIf auth blockers.
• Healthy signals: status --daemon reports fingerprintCurrent === true; explicit-CDP lifecycle commands return success; authProvenance stays sanitized; Google user-owned auth attempts outside extension /ops fail closed.
• Failure signals: raw profile paths, launch tokens, cookie values, OAuth/account identifiers, or websocket endpoints appear in CLI JSON; stale Chrome processes remain after cdp-profile stop; Inspiredesign/Pinterest marks diagnostic-only evidence as product-ready.
• Validation window: maintainers should watch early user reports and CI/PR smoke failures for one week after merge. Rollback trigger is any credential leak, Google auth fail-open, repeatable stuck explicit-CDP profile process, or product-readiness overclaim; mitigation is reverting this PR and preserving evidence artifacts for diagnosis.

---