Add managed Chromium auth fallback

[theotarr]

Summary

• add a lazy managed Chromium installer backed by the pinned Playwright browser revision
• use installed Chrome/Chromium/Edge/Brave first, then install or refresh managed Chromium only when needed
• add CLI status/install commands and keep managed browser storage under ~/.cued/browsers
• harden installs with metadata validation, atomic promotion, and an install lock

Testing

• PATH="/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/theotarr/.codex/tmp/arg0/codex-arg0GNFXwq:/Users/theotarr/.local/bin:/Users/theotarr/.antigravity/antigravity/bin:/Users/theotarr/.bun/bin:/opt/homebrew/opt/openjdk/bin:/Users/theotarr/Library/pnpm:/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/Users/theotarr/.cargo/bin:/Users/theotarr/.lmstudio/bin:/Applications/Codex.app/Contents/Resources" pnpm check:biome
• PATH="/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/theotarr/.codex/tmp/arg0/codex-arg0GNFXwq:/Users/theotarr/.local/bin:/Users/theotarr/.antigravity/antigravity/bin:/Users/theotarr/.bun/bin:/opt/homebrew/opt/openjdk/bin:/Users/theotarr/Library/pnpm:/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/Users/theotarr/.cargo/bin:/Users/theotarr/.lmstudio/bin:/Applications/Codex.app/Contents/Resources" pnpm build
• PATH="/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/theotarr/.codex/tmp/arg0/codex-arg0GNFXwq:/Users/theotarr/.local/bin:/Users/theotarr/.antigravity/antigravity/bin:/Users/theotarr/.bun/bin:/opt/homebrew/opt/openjdk/bin:/Users/theotarr/Library/pnpm:/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/Users/theotarr/.cargo/bin:/Users/theotarr/.lmstudio/bin:/Applications/Codex.app/Contents/Resources" pnpm exec tsc --noEmit
• PATH="/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/theotarr/.codex/tmp/arg0/codex-arg0GNFXwq:/Users/theotarr/.local/bin:/Users/theotarr/.antigravity/antigravity/bin:/Users/theotarr/.bun/bin:/opt/homebrew/opt/openjdk/bin:/Users/theotarr/Library/pnpm:/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/Users/theotarr/.cargo/bin:/Users/theotarr/.lmstudio/bin:/Applications/Codex.app/Contents/Resources" pnpm test
• PATH="/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/pmk/env/global/bin:/Library/Apple/usr/bin:/Library/TeX/texbin:/opt/homebrew/bin:/Users/theotarr/.codex/tmp/arg0/codex-arg0GNFXwq:/Users/theotarr/.local/bin:/Users/theotarr/.antigravity/antigravity/bin:/Users/theotarr/.bun/bin:/opt/homebrew/opt/openjdk/bin:/Users/theotarr/Library/pnpm:/Users/theotarr/.nvm/versions/node/v24.4.0/bin:/Users/theotarr/.cargo/bin:/Users/theotarr/.lmstudio/bin:/Applications/Codex.app/Contents/Resources" pnpm build:app:macos
• temp-root real smoke: node dist/cli.js browser install, then launched installed managed Chromium with Playwright headless

Notes

• Local commit/push hooks were bypassed because they invoke the shell default Node 25; that fails native sqlite ABI loading. The same checks pass under the repo-supported Node 24.
• Stacked on Unbundle Chromium from macOS app #39 / codex/unbundle-chromium-auth-browser.