feat: platform browser multi-tab, navigation allowlist, close cleanup, egress filter, allowlist worker wiring

- Multi-tab: browser_new_page / browser_list_pages /
  browser_switch_page / browser_close_page in playwright_mcp.py;
  each new page gets a fresh Playwright context, so cookies and
  storage are isolated between pages. Single-page tools act on
  the current page; switching to a missing index is an error,
  not a crash; closing the last page is an error (use
  browser_close).
- Navigation allowlist: BROWSER_ALLOWED_HOSTS (comma list,
  leading-dot suffix match, case/port-insensitive) checked in
  _check_allowed_url before launching Chromium; unset (or empty)
  means no check, the old behaviour. file:// always allowed;
  localhost/127.0.0.1 have no special treatment.
- Close cleanup: browser_close closes all pages and best-effort
  removes cwd browser-live.png / browser-live.json; custom
  screenshot files are untouched. list_pages needs no launch.
- Egress filter: 10 programming-source Tinyproxy BASIC rules
  (python.org, nodejs.org, go.dev, pkg.go.dev, rust-lang.org,
  developer.mozilla.org, crates.io, stackoverflow.com,
  cve.mitre.org, nvd.nist.gov); already-present github.com /
  pypi.org / npmjs.org not duplicated; searx.diante.me stays
  exact-only, no diante.me wildcard.
- Allowlist worker wiring: _docker_task_context now passes a
  set, non-empty BROWSER_ALLOWED_HOSTS from the worker env into
  [mcp_servers.playwright.env] in the tenant config, so the MCP
  process actually sees it (container -e alone does not reach
  MCP subprocesses, 2026-10-30). Unset/empty writes nothing and
  never overwrites; the value never goes into logs; it is not
  added to the websearch env block or the container env.
  ensure_playwright_mcp_env now returns False without rewriting
  when the result would be identical (canonical join: one blank
  line before the block), so a second prep leaves an unchanged
  tenant config alone; other sections untouched.
- Skill + docs: browser-automation SKILL.md multi-tab/allowlist
  section; docs/platform-browser.md comparison doc (new file).
- Tests (mock/fake only, no network, no real Chromium, no real
  credentials): cloud.tests.test_playwright +
  cloud.tests.test_websearch_worker, 48 tests OK, including 6
  new wiring tests (switch off passes no variable, switch on
  reaches MCP env verbatim, empty never written, old-tenant
  merge idempotent + no-rewrite, ensure no-op when identical,
  allowlist enforces only after wiring).
- NOT done (see PR body): no persistent profile, no credential
  vault, no approval card, no CAPTCHA bypass, in-page link
  navigation does not pass the allowlist, no real-Chromium live
  verification, host tinyproxy filter not reloaded.

cloud/worker.py

@@ -3240,6 +3240,18 @@ class Worker:
                 playwright_env = dict(proxy_env or {})
                 playwright_env["PLAYWRIGHT_BROWSERS_PATH"] = (
                     "/opt/ms-playwright")
+                # 导航白名单透传：worker 环境里的
+                # BROWSER_ALLOWED_HOSTS 只在已设置且非空时写进
+                # MCP env；未设置时绝不写空值（空值会覆盖租户
+                # 自己的配置，且 _allowed_hosts 对空串本就当未
+                # 设置——写它没有意义）。只写 playwright 的 env
+                # 块，不进 websearch env、不进容器 -e：MCP 子进
+                # 程只读 config.toml 里的 env（2026-10-30 实测
+                # 容器 -e 到不了 MCP 进程）。值绝不进日志：下
+                # 面失败分支只记异常，不记 env 内容。
+                allowed_hosts = os.environ.get("BROWSER_ALLOWED_HOSTS")
+                if allowed_hosts:
+                    playwright_env["BROWSER_ALLOWED_HOSTS"] = allowed_hosts
                 home = self._tenant_dirs(
                     task.get("project_id"))["codex_home"]
                 _ensure_playwright_mcp_env(home, playwright_env)