fix(chv): 快照改走 page.aria_snapshot()

Playwright 1.64.1 已移除 page.accessibility，真实快照一路报
AttributeError（P2 假实现用的旧 API，单测一直没抓到；2026-11-08
构建 #8 驱动 live 抓到）。新版 aria_snapshot() 返回字符串，
超 64KB 截断；旧版 accessibility.snapshot()（dict）只作回落。
驱动的 a11y 断言接受 str 或 dict。

cloud/tests/test_chv_muse_p2.py

@@ -554,7 +554,8 @@ class BrowserTest(unittest.TestCase):
             self.assertTrue(resp["ok"])
             self.assertEqual(resp["title"], "Example Domain")
             self.assertEqual(resp["url"], "https://example.com/")
-            self.assertEqual(resp["a11y"]["role"], "WebArea")
+            self.assertIsInstance(resp["a11y"], str)
+            self.assertIn("Example Domain", resp["a11y"])
             snap = agent.snapshot()
             self.assertTrue(snap["ok"])
             shot = agent.screenshot()
@@ -590,6 +591,11 @@ class FakePage:
         return {"role": "WebArea", "name": "Example Domain",
                 "children": [{"role": "heading", "name": "Example"}]}
 
+    def aria_snapshot(self):
+        # 当前 Playwright（1.64.1）：快照是字符串，不是 dict 树。
+        return ("- heading \"Example Domain\" [level=1]\n"
+                "- paragraph \"Example\"")
+
     def screenshot(self, path=None, type=None, quality=None):
         data = b"\xff\xd8\xff\xe0FAKEJPEG"
         if path:

cloud/tests/test_chv_opt_stage3.py

@@ -55,6 +55,9 @@ class FakePage:
         return {"role": "WebArea", "name": self._title,
                 "children": [{"role": "heading", "name": self._title}]}
 
+    def aria_snapshot(self):
+        return "- heading \"%s\" [level=1]" % self._title
+
     def screenshot(self, path=None, type=None, quality=None):
         assert type == "jpeg", type
         assert quality == 70, quality
@@ -201,6 +204,46 @@ class MultiSessionTest(unittest.TestCase):
                              {"A", "B"})
 
 
+class SnapshotApiTest(unittest.TestCase):
+    def test_snapshot_returns_aria_string(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            agent, _c, _h = _agent([FakePage("Example Domain")], tmp)
+            agent.open("https://example.com")
+            snap = agent.snapshot()
+            self.assertTrue(snap["ok"])
+            self.assertIsInstance(snap["a11y"], str)
+            self.assertIn("Example Domain", snap["a11y"])
+            self.assertFalse(snap["truncated"])
+
+    def test_snapshot_truncates_long_aria_string(self):
+        class LongPage(FakePage):
+            def aria_snapshot(self):
+                return "x" * (BROWSER.MAX_A11Y_CHARS + 100)
+
+        with tempfile.TemporaryDirectory() as tmp:
+            agent, _c, _h = _agent([LongPage()], tmp)
+            agent.open("https://example.com")
+            snap = agent.snapshot()
+            self.assertTrue(snap["truncated"])
+            self.assertLessEqual(len(snap["a11y"]),
+                                 BROWSER.MAX_A11Y_CHARS)
+
+    def test_snapshot_falls_back_to_legacy_accessibility(self):
+        # 旧版页只有 accessibility.snapshot()（dict 树）时回落。
+        class LegacyPage(FakePage):
+            @property
+            def aria_snapshot(self):
+                raise AttributeError("no aria_snapshot")
+
+        with tempfile.TemporaryDirectory() as tmp:
+            agent, _c, _h = _agent([LegacyPage("Legacy")], tmp)
+            agent.open("https://example.com")
+            snap = agent.snapshot()
+            self.assertTrue(snap["ok"])
+            self.assertIsInstance(snap["a11y"], dict)
+            self.assertEqual(snap["a11y"]["role"], "WebArea")
+
+
 class ScreenshotTest(unittest.TestCase):
     def test_jpeg_q70_width_1280(self):
         with tempfile.TemporaryDirectory() as tmp: