fix(runtime): timeout wedged snapshot after renderer crash

[cursor]

Bug and impact

After a renderer crash (e.g. navigate to chrome://crash), an immediate snapshot calls page.content() while CDP is wedged. Playwright’s own content({ timeout }) never settles, so companion POST /commands and MCP snapshot hang indefinitely. Other sessions and createSession still work (distinct from #10).

Trigger

1. POST /sessions
2. navigate to chrome://crash → COMMAND_FAILED quickly
3. Immediate snapshot on the same session → hangs forever on HEAD a0fabe3

Live Chromium: delay=0 hang reproduced 3/3; delay≥50ms eventually fails with Target crashed. Companion HTTP abort after 15s confirmed hang; /health still OK.

Why distinct from #10–#21

• Not fix(runtime): recover from dead browser without companion restart #10: browser stays up; createSession and peer sessions succeed while the crashed session’s snapshot is wedged.
• Not shutdown/orphan PRs (fix(runtime): block session creation during companion shutdown #12/fix(companion): rollback session when POST /sessions fails after create #14/fix(runtime): close browser after partial session teardown failures #15/fix(runtime): disable Playwright process signal handlers #19).
• Not URL/auth/secret leak PRs (fix(runtime): block file and internal navigate targets #16–fix(runtime): redact password fields in page snapshots #18/fix(runtime): block click-driven navigation to internal URLs #20/fix(runtime): redact URL userinfo in command results #21/fix(companion): reject empty local token as auth bypass #17).

Prior hunts misfiled chrome://crash as a #10 vector; the failure mode is an unbounded snapshot hang, not a dead browserPromise.

Fix

• Host-side Promise.race timeout around snapshot CDP reads (page.content / aux / title).
• page.on("crash") + session pageCrashed flag for fail-fast on later commands.
• Unit + live companion integration coverage.

Validation

• pnpm --filter @webchain/runtime test / test:coverage / typecheck
• pnpm --filter @webchain/companion test:integration (includes crash→snapshot case, <8s)
• biome check on touched files