Add SLAB local browser integration for webcmd

[beubax]

Summary

• add SLAB installation discovery, setup consent, and first-use local browser enforcement
• replace the local Cloak runtime boundary with SLAB provider/bridge attach-release flow while preserving existing session, concurrency, and adapter behavior
• keep hosted mode isolated from SLAB and update user-facing docs/skills/gates away from Cloak

Verification

• npm run typecheck
• npm run build
• npm run check:hosted-contract
• npm test — 445 files passed, 5702 passed, 1 skipped
• npx vitest run --project e2e tests/e2e/slab-session-concurrency.test.ts tests/e2e/slab-runtime.test.ts — 2 files skipped cleanly without installed SLAB
• uv run pytest tests/test_controller.py tests/test_axi_runtime.py in benchmarks/ — 276 passed
• npm ls cloakbrowser --depth=0 — empty root dependency tree

Notes

• The native SLAB browser distribution is intentionally not included here; it belongs in the separate private slab-browser repo once available locally.
• The private benchmark harness explicitly retains its legacy CloakBrowser dependency boundary for historical comparability; it is not the webcmd local runtime.

[github-actions]

🟠 Maintainer review suggested — low confidence

The automated review could not reach a fully supported conclusion.

Limitations

• The automated review returned an invalid structured result.
• Some review context was unavailable or reduced.

This review is advisory and does not block merging.