feat: share built-in browser across runtimes

The built-in browser was limited to direct-model tools, and its Agent switch also blocked manual Browser workbar actions. It is now a request-scoped GoodBuddy capability assignable to direct models, managed OpenCode, and Continue, while manual browser controls remain available when Agent access is off.

Existing browser enablement migrates to capability settings version 6. DeepSeek Harness remains unsupported.

Release note: 内置浏览器现在可分配给直连模型、OpenCode 和 Continue；关闭 Agent 浏览器能力不会影响用户在浏览器工作栏中的手动操作。

FEATURES.md

@@ -435,12 +435,13 @@ otherwise.
 
 - [x] **Shared built-in browser for runtimes**: Uses GoodBuddy's isolated
   Chromium and never controls a browser installed by the user. A separate
-  master switch decides whether Execute receives the capability, with no
-  per-use prompt after enablement. The Browser workbar and Agent share the same
-  Conversation-owned session and serialized operation path, with Back,
-  Refresh/Stop Loading, address entry, Go, Interaction, and Close actions.
-  Stop Loading does not close the session, and user navigation changes the
-  page the Agent sees next.
+  master switch decides whether assigned runtimes receive the capability in
+  Execute, with no per-use prompt after enablement. Turning Agent access off
+  does not disable manual browser workbar actions. The Browser workbar and
+  Agent share the same Conversation-owned session and serialized operation
+  path, with Back, Refresh/Stop Loading, address entry, Go, Interaction, and
+  Close actions. Stop Loading does not close the session, and user navigation
+  changes the page the Agent sees next.
 - [x] **Client-computer control tools**: Managed separately from the built-in
   browser with scope, cancellation, timeout, output, and activity boundaries.
 - [x] **Remote messaging-channel projects**: WeChat ClawBot, WeCom, and