[REQ-106] Isolated Browser Workbench and session broker

[jinjunnn]

Goal

实现 main-owned WebContentsView、BrowserSessionBroker、用户接管、policy 与受管 I/O。

Parent requirement

jinjunnn/alpha-code#213

Scope

• Deliver the jinjunnn/alpha-code boundary for Alpha REQ-106: Isolated Browser Workbench and session broker.
• Preserve the parent requirement contract; do not absorb adjacent repository work.

Out of scope

• Work owned by sibling sub-issues or future REQs.

Acceptance criteria

• 越域/权限默认拒绝；agent pause/takeover 可用；main window/CDP 无泄露。
• Relevant automated and packaged/runtime checks are attached before closure.

Dependencies

REQ-094/096；D5 verification pending；本 Issue 在实测证据完成前保持 blocked-by D5。

Verification evidence

• CI/test evidence.
• Security/runtime/product acceptance evidence appropriate to this repository.

[jinjunnn]

随父需求 alpha-code#213 一并关闭(owner 2026-09-17 裁决不做)。