Add adversarial browser environment matrices

[chubes4]

Summary

• add a product-neutral wp-codebox/browser-environment-matrix/v1 contract with canonical cartesian expansion, stable per-cell seeds/identity, required and optional capability negotiation, and sequential bounded execution
• add a Playwright adapter for viewport/device/touch/DPR/orientation, media preferences, locale/timezone, online state, clock state, page-scale zoom, caller-declared CPU/network profiles, and generic capability state
• persist collision-free per-run/per-cell evidence namespaces and an aggregate replayable matrix report while retaining completed evidence after findings, execution errors, timeouts, resolver failures, and budget exhaustion

Fixes #2024

Contract and expansion semantics

Dimensions and values are sorted by stable ids before cartesian expansion, independent of declaration or object insertion order. Cell ids and seeds derive from the matrix seed, canonical requested environment, and selected dimension values. Conflicting assignments fail validation, while independent capability state merges deterministically.

The runner composes existing browser probe, action, adaptive, visual, accessibility, and multi-actor executors through an execution callback rather than duplicating those systems. Execution is sequential by default. Environment cell identity participates in default finding fingerprints and replay metadata.

Bounds and resources

Construction rejects matrices exceeding maxCells or whose reserved cells * maxCellDurationMs exceeds maxDurationMs. Runtime execution separately enforces per-cell time, total wall time, interruption, and aggregate maxArtifactBytes; all completed-cell evidence is retained when a later cell or resource limit fails. browserEnvironmentMatrixFailed() preserves fail-on-finding behavior while allowing explicitly advisory matrices.

Artifacts and provenance

Each run reserves browser-matrices/<matrix-id>/<run-id>/ exclusively and rejects an existing namespace. Cells write beneath cells/<index>-<cell-id>/, and matrix-report.json records cell identity, requested/effective environment, provider/browser/channel/version, capability fidelity, status/findings, timing, artifact refs, unsupported/inconclusive dimensions, and replay command/contract.

Unsupported capability handling

Required unsupported capabilities fail closed without executing the cell. Optional unsupported capabilities retain safe execution and mark an otherwise passing cell inconclusive. Zoom and CPU/network debugging-protocol controls are labeled emulated; unknown device/resource profiles are unsupported. OS/browser-chrome zoom, server clocks, and socket transport faults are not claimed.

Tests

Passed:

• npm run build
• npm run test:browser-environment-matrix (10 tests, including real-browser environment application and artifact-collision fixtures)
• npm run test:adversarial-runtime
• npm run test:browser-scenarios
• npm run test:browser-visual-compare-capture-reliability
• npm run test:schema-parity
• npm run test:recipe-validation-descriptors
• npm run test:public-api-contract
• npm run test:production-boundary-enforcement

Repository check baseline failures, unrelated and unchanged by this PR:

• npm run check reaches command-registry-smoke and fails on wordpress.collect-workload-result outputShape should mention outputSchema id; tracked in command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745, and both the registry and smoke files are unchanged.
• npm run test:docs-boundary-language fails on existing agents/... examples in docs/agent-task-reusable-workflow.md; tracked in test(docs): align boundary-language gate with existing reusable-workflow paths #2061, and git diff --exit-code origin/main -- docs/agent-task-reusable-workflow.md passes.