feat(browser): add first-use browser control opt-in and setup

[galz10]

Summary

Adds a first-use browser-control consent flow and app-managed setup pipeline so browser surfaces can be opened immediately while enabling MCP-based browser automation for supported installed CLIs.

Details

• Added BrowserControlConsent state to app settings (undecided / enabled / declined) with schema migration defaults.
• Added consent-aware browser entrypoints in SessionService:
  • requestToggleBrowserSplit(...)
  • requestOpenURLInSplit(...)
  • requestAddNiriBrowserTile(...)
• Added queued browser-intent replay logic:
  • First browser open while undecided shows a modal and queues intent.
  • Not now stores declined and replays queued action(s).
  • Enable Browser Control runs setup; on success stores enabled and replays queued action(s).
  • Setup failure keeps consent unresolved, shows retry/error state, and still replays queued action(s).
• Added BrowserControlConsentSheet to main window sheet stack.
• Added Advanced settings controls:
  • Enable browser control (when declined/undecided)
  • Re-run setup (when enabled)
  • Reset consent to undecided (testing support)
• Added BrowserControlSetupService actor:
  • Installs pinned @playwright/mcp@0.0.68 under app support (.../idx0/browser-control/)
  • Generates executable wrapper script using a dedicated Chromium profile dir
  • Configures installed CLIs in one pass (codex, claude, gemini) using each CLI’s MCP commands
  • Skips non-installed tools, fails with actionable errors for installed-tool config failures
  • Uses a manifest marker for idempotent repeated runs
• Added OpenCode runtime MCP merge:
  • Writes/merges idx0-browser local MCP entry into isolated xdg-config/opencode/opencode.json without clobbering existing config.
• Added T3 runtime troubleshooting note in runtime logs when browser control is enabled.
• Added/updated tests for settings migration, consent gating behavior, setup service idempotency/failure, and OpenCode config merge.

Related Issues

N/A

How to Validate

1. Run targeted coverage for this change:
   • xcodebuild -project idx0.xcodeproj -scheme idx0 -destination 'platform=macOS' test -only-testing:idx0Tests/AppSettingsKeyboardTests -only-testing:idx0Tests/OpenCodeRuntimeTests -only-testing:idx0Tests/BrowserControlSetupServiceTests -only-testing:idx0Tests/SessionServiceTests/testBrowserConsentPromptAppearsAndQueuesOnFirstBrowserOpen -only-testing:idx0Tests/SessionServiceTests/testBrowserConsentDeclineReplaysQueuedIntentAndSuppressesFuturePrompt -only-testing:idx0Tests/SessionServiceTests/testBrowserConsentEnableSuccessStoresEnabledAndReplaysQueuedIntent -only-testing:idx0Tests/SessionServiceTests/testBrowserConsentEnableFailureKeepsUndecidedShowsErrorAndStillReplaysIntent -only-testing:idx0Tests/SessionServiceTests/testBrowserConsentGateCoversNiriBrowserTileAndClipboardOpen
2. Run full suite:
   • xcodebuild -project idx0.xcodeproj -scheme idx0 -destination 'platform=macOS' test
3. Expected full-suite status:
   • Existing known failures remain in Niri sizing persistence tests:
     • SessionServiceTests/testNiriColumnResizePersistsPreferredWidths()
     • SessionServiceTests/testNiriDefaultTileSizesApplyOnlyToNewTiles()
     • SessionServiceTests/testNiriItemResizePersistsPreferredHeights()
4. Manual smoke test:
   • Launch app, trigger browser split or Niri browser tile on first use, confirm consent sheet appears.
   • Verify Not now still opens requested browser surface and suppresses future prompts.
   • Use Settings -> Advanced to enable/re-run browser control and verify flow completes.

Pre-Merge Checklist

• Builds successfully (xcodebuild / Xcode)
• Added/updated tests (if needed)
• Updated relevant documentation and README (if needed)
• Noted breaking changes (if any)
• Tested on macOS