Browser-flavored sandbox image with in-image session tooling

[czpython]

What

First phase of browser sessions as a druks primitive: the sandbox image gains a browser flavor and the session tooling that keeps druks core blind to browser-state formats.

• Dockerfile: named slim/browser stages. The browser stage adds chromium (via pinned playwright, browsers under /ms-playwright), a pinned checksum-verified pinchtab binary, fonts, Xvfb, and x11vnc. Everything slim has stays present — harnesses run in browser sandboxes too. Untargeted local builds keep producing slim via a final default alias stage.
• entrypoint: the browser flavor starts Xvfb (:99) and x11vnc bound to 127.0.0.1:5900 with a 0600 password file generated at boot, and fails the boot loudly if either doesn't come up. Slim starts neither. VNC is loopback-only; SSH stays the only ingress.
• session-launch / session-export: image-owned scripts that interpret session formats so druks core never does. Launch materializes a profile tarball or applies a storage_state JSON to a persistent context (raw Chromium can't consume storage_state) and exposes loopback CDP for playwright and pinchtab alike; export closes the browser first (never tars a live Chrome), archives the profile without caches, validates the archive, and writes tar + meta to /work/session/out/. Both scripts are self-contained under SSH invocation, which carries none of the image ENV.
• sandbox client: browser=True on ephemeral/acquire/provision resolves the configured image to its browser tag (an explicit image_override still wins). Browser hosts always name their image explicitly, so they bypass the default-image warm pool.
• publish workflow: builds and pushes both flavors — existing tags for slim, browser/browser-sha-*/browser-<tag> for the browser target.

Testing

• Unit tests cover browser-tag resolution (default, untagged, tagged, registry-with-port, digest-pinned) and browser=True flowing into create_host(image=...); they run in CI (local runs are blocked by the shared-DB fixture).
• ruff, ruff format, pyright, bash -n, node --check all clean.
• Image boot, VNC handshake, both session round trips, and the harness-in-browser-sandbox check are CI/manual docker verification once the image publishes.