base: bake agent-browser + Playwright Chromium (headless browsing, all variants)

Gives the agent a real browser it can drive so front-end work involving live
DOM/WebGL can be VERIFIED, not guessed. The agent-browser skill (from the
skillset repo) was a no-op without the binary; it now works out of the box.

- agent-browser CLI (standalone Rust, ships no browser) via npm, prefixed
  NPM_CONFIG_PREFIX=/usr so it survives the ~/.pi/npm-global volume.
- Chromium fetched with 'playwright install --with-deps chromium' into
  PLAYWRIGHT_BROWSERS_PATH=/usr/local/share/ms-playwright — a system path that
  the /home/developer volume can't shadow (unlike agent-browser's own
  ~/.agent-browser/browsers default, which WOULD vanish on recreate).
- Stable /usr/local/bin/agent-chrome symlink, exported as
  AGENT_BROWSER_EXECUTABLE_PATH, insulates the ENV from Playwright's
  per-version chromium-<rev> dir name.

Verified end-to-end (this session): agent-browser drives the baked Chromium
headless (open + title + screenshot + eval into a WebGL SPA); doctor launch
test passes in ~0.5s. Debian trixie --with-deps resolution verified (exit 0;
t64 lib renames handled). hadolint clean; check-base-hash OK (only *_VERSION
args added). Cost ~960 MB (Chromium + headless shell). Base-affecting →
rebuilds base-<hash> on next release.

CHANGELOG.md

@@ -15,6 +15,24 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ### Added
 
+- **`agent-browser` — headless browser automation, baked into every variant.**
+  The base now ships the [`agent-browser`](https://www.npmjs.com/package/agent-browser)
+  CLI plus a Playwright-fetched Chromium, so the agent can drive a real browser
+  (open/click/fill/`eval`/screenshot/snapshot) and *verify* front-end work
+  involving live DOM or WebGL instead of guessing. The `agent-browser` skill
+  (from the skillset repo) was previously a no-op because the binary was
+  absent; it now works out of the box. Two pieces: the standalone Rust CLI
+  (npm, `NPM_CONFIG_PREFIX=/usr` so it survives the `~/.pi/npm-global` volume),
+  and a Chromium fetched via `playwright install --with-deps chromium` into
+  `PLAYWRIGHT_BROWSERS_PATH=/usr/local/share/ms-playwright` (a system path,
+  never shadowed by the `/home/developer` volume — unlike agent-browser's own
+  `~/.agent-browser/browsers` default). A stable `/usr/local/bin/agent-chrome`
+  symlink, exported as `AGENT_BROWSER_EXECUTABLE_PATH`, insulates the config
+  from Playwright's per-version `chromium-<rev>` directory name. Debian trixie
+  `--with-deps` dependency resolution verified (the t64 renames are handled).
+  Adds ~960 MB (Chromium + headless shell). Base-affecting, rebuilds
+  `base-<hash>`.
+
 - **`pi-devbox-version` command.** Wraps `/etc/pi-devbox/build-manifest.json`
   into a human-readable summary (release tag, build date, source revision,
   baked `pi_version`, and short SHAs for every `/opt` component) instead of