feat(browser): attach passive tools to browsers without HTTP discovery (#2346)

* feat(browser): attach passive tools to browsers without HTTP discovery

Accept a literal loopback browser WebSocket,
ws://127.0.0.1:PORT/devtools/browser/ID, as the cdp_endpoint of the six
passive browser tools. Discovery then reads Browser.getVersion and
Target.getTargets over that socket, and the target session adopts the
same socket, so a browser that asks for consent per connection prompts
once per call.

The socket identifier gates access, so Evidence records the endpoint as
ws://127.0.0.1:PORT/devtools/browser/[REDACTED], and runtime
reconciliation accepts that recorded form. HTTP endpoints and their
Evidence are unchanged. Electron, web runtime, scenario and Inspector
endpoints stay HTTP-only.

Refs #2288

* test(browser): match browser-socket captures against HTTP discovery

Check in the real Chrome lane that DevToolsActivePort names the same
browser socket as /json/version, and that inspecting the selected page
through that socket leaves DOM structure and scripts unchanged compared
with an inspection through HTTP discovery.

Refs #2288

* fix(browser): bound browser-socket handshake and report discovery timeouts

Run the browser-socket WebSocket handshake and both discovery commands
under one discovery deadline, so a port that accepts the connection but
never completes the upgrade times out instead of waiting forever.

Report a reached deadline as a timeout without carrying the internal
abort as its cause, so CLI and MCP project provider_timeout rather than
cancelled. Caller cancellation is still reported as cancelled.

Refs #2288

src/domain/javascript/javascriptRuntimeReconciliationCaptureParsing.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import {
   browserAllowedOriginsSchema,
   browserEndpointSchema,
+  recordedBrowserObservationEndpointSchema,
 } from "../browserObservation.js";
 import {
   webPageInspectionSchema,
@@ -424,14 +425,17 @@ const assertRuntimeParameters = (
 ): void => {
   const common = {
     target_id: z.string().trim().min(1),
-    cdp_endpoint: browserEndpointSchema,
     include_script_sources: z.boolean(),
   };
   if (expected.kind === "browser") {
     const parameters = parseAtPath(
       (value) =>
         z
-          .object({ ...common, allowed_origins: browserAllowedOriginsSchema })
+          .object({
+            ...common,
+            cdp_endpoint: recordedBrowserObservationEndpointSchema,
+            allowed_origins: browserAllowedOriginsSchema,
+          })
           .passthrough()
           .parse(value),
       evidence.parameters,
@@ -455,7 +459,11 @@ const assertRuntimeParameters = (
     return;
   }
   const parameters = parseAtPath(
-    (value) => z.object(common).passthrough().parse(value),
+    (value) =>
+      z
+        .object({ ...common, cdp_endpoint: browserEndpointSchema })
+        .passthrough()
+        .parse(value),
     evidence.parameters,
     [...path, "parameters"],
   );