Implement bounded browser service, consumer evidence and managed package

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13590-a16f-7f60-be60-fd71627bc99d

tools/chromium-launcher.py

@@ -0,0 +1,29 @@
+#!/usr/bin/python3
+"""Keep the browser process group tied to its worker, even during launch/crash.
+
+Playwright starts this launcher in a new process group. Linux PR_SET_PDEATHSIG
+closes the gap before launchServer() has returned a browser PID to the service.
+"""
+import ctypes
+import os
+import signal
+import subprocess
+import sys
+
+
+def terminate(_signal, _frame):
+    os.killpg(os.getpgrp(), signal.SIGKILL)
+
+
+parent = os.getppid()
+signal.signal(signal.SIGTERM, terminate)
+signal.signal(signal.SIGINT, terminate)
+libc = ctypes.CDLL(None, use_errno=True)
+if libc.prctl(1, signal.SIGTERM, 0, 0, 0) != 0:
+    sys.exit(70)
+if os.getppid() != parent or parent == 1:
+    terminate(None, None)
+binary = os.environ['RAPP_CHROMIUM_EXECUTABLE']
+# Playwright's --remote-debugging-pipe uses these inherited descriptors.
+child = subprocess.Popen([binary, *sys.argv[1:]], pass_fds=(3, 4))
+sys.exit(child.wait())

tools/render.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Render only a supplied immutable image; no floating defaults can deploy."""
+import os
+from pathlib import Path
+import re
+
+image = os.environ.get('IMAGE_REFERENCE', '')
+if not re.fullmatch(r'forgejo\.coulomb\.social/coulomb/rapp-playwright@sha256:[a-f0-9]{64}', image):
+    raise SystemExit('IMAGE_REFERENCE must be the published rapp-playwright sha256 reference')
+source = Path('manifests/workload.yaml').read_text()
+rendered = source.replace('${IMAGE_REFERENCE}', image)
+if '${' in rendered:
+    raise SystemExit('unresolved template field')
+out = Path('.rendered')
+out.mkdir(exist_ok=True)
+(out / 'workload.yaml').write_text(rendered)
+(out / 'namespace.yaml').write_text(rendered.split('---',1)[0])
+print(out / 'workload.yaml')