fix: provision the agent-browser runtime for its skill stub

[antomanc]

Fixes #4

The web preset installs the .agents/skills/agent-browser skill stub, but nothing ever installed the CLI or the browser it drives — every agent-browser command fails with command not found, and even a working CLI would then die on Ubuntu's sandbox restriction.

What changed

New src/adapters/agent-browser.ts

• setupAgentBrowser() — npm i -g agent-browser only when the CLI is missing from PATH, then agent-browser install for the browser binaries (idempotent, ~0.1s when already present). A failed provisioning returns false so init reports an incomplete setup, matching the Graft contract.
• findUsernsRestriction() — detects kernel.apparmor_restrict_unprivileged_userns=1 and kernel.unprivileged_userns_clone=0. Detect & warn only: reports the persisted sysctl fix (/etc/sysctl.d/99-agent-browser-userns.conf) and the narrower --args "--no-sandbox" alternative, never changes system settings, never fails the run.
• runAgentBrowserDiagnostics() — orchestrates upstream's own agent-browser doctor --quick --offline --json (0.2s) instead of duplicating browser-health logic.

aginit init — conditional step [6/7] Provisioning agent-browser runtime, gated on the skill being in skills.sources or its stub already on disk. Non-web projects stay at 6 steps. Honors --dry-run (prints would-run lines) and --no-skills.

aginit doctor — three new checks, only when the project ships the skill (or Playwright for the sandbox one):

• agent-browser CLI — presence + version, suggestion npm i -g agent-browser && agent-browser install
• agent-browser browser runtime — upstream quick/offline JSON findings with their fixes
• Chrome sandbox (unprivileged user namespaces) — the sysctl from the issue, with both remediations

Verification

• pnpm typecheck && pnpm test && pnpm build — 12 files, 97 tests (13 new in tests/agent-browser.test.ts: detection, provisioning success/failure/dry-run, sandbox warning rendering, init wiring, doctor output)
• Live smoke: doctor against a web config shows ✓ agent-browser CLI (0.39.0) / ✓ browser runtime / ✓ Chrome sandbox; a config without the skill prints no agent-browser output at all; the missing-CLI case prints the exact install suggestion; a simulated blocked kernel renders both fixes while still succeeding; --dry-run shows correct 7-step numbering with no writes
• README + CHANGELOG updated

Notes:

• Global install uses npm i -g regardless of the project's package manager — it matches the skill stub's own install line, npm ships with Node, and pnpm/yarn-global bin dirs are not reliably on PATH (same precedent as the Graft suggestion).
• npm 11's allowScripts warning about agent-browser's postinstall is advisory; install exits 0 and the shipped binary works (confirmed).