fix(browser): preserve signed-in open recovery budget

[artemgetmann]

Review Fast Path

• User path fixed: browser.open profile="signed-in" on Chrome MCP cloned signed-in browser no longer aborts the open/recovery path with a misleading gateway restart error while browser.status is healthy.
• Proof: pnpm test -- src/browser/client.test.ts src/browser/client-fetch.loopback-auth.test.ts src/agents/tools/browser-tool.test.ts; pnpm tsgo.
• Shared-state footgun removed: in-process browser-operation timeouts are no longer reported as dead gateway/control-service reachability failures.
• Still hurts: live Jarvis runtime proof still requires merge + runtime ship from sacred main.

Why This Matters

• status proves Chrome MCP can attach and list tabs; open exercises new_page and its post-timeout tab recovery path.
• Before this patch, the client used the same deadline for the new_page operation and the whole route, so recovery could be aborted before it listed the tab Chrome had already opened.
• signed-in is a Chrome MCP existing-session profile now, but the longer open budget was only hardcoded for user-live.

Scope Boundary

• Changed timeout budgeting for browser open only.
• Preserved existing Chrome attach approval guidance.
• Did not change signed-in/openclaw/user-live fallback policy.
• Did not kill/relaunch Chrome from product policy.

Verification

• pnpm test -- src/browser/client.test.ts src/browser/client-fetch.loopback-auth.test.ts src/agents/tools/browser-tool.test.ts
• pnpm tsgo

AI Assistance

• AI-assisted
• Testing degree: targeted