browser: minor hardening & cleanup follow-ups (symlink confinement, screenshot fallback, dedup, profile sweep, criticals count)

[initializ-mk]

Summary

A basket of small, non-blocking hardening/cleanup follow-ups for the browser tool family (#94, PR #260). Each is independent and low-risk.

Security-adjacent residuals (from the PR #260 re-review of the path-confinement fix)

• Symlink confinement. confinedFilesPath (forge-core/runtime/loop.go) resolves paths with filepath.Abs + filepath.Rel, but not filepath.EvalSymlinks. A symlink inside the files dir pointing outside would pass the check (requires an attacker who can already create symlinks in the files dir — low severity). Add EvalSymlinks for defense in depth.
• Screenshot fallback dir never attaches. The screenshot tool falls back to <WorkDir>/.forge-browser/shots when no files dir is on the context, but the loop only attaches from the files dir — so screenshots written there are saved and silently never attached. Align the two: either drop the fallback and tell the LLM, or have the loop confine to both known dirs.

Minor cleanups

• Chromium dedup by alias. The synthetic chromium injection (forge-cli/build/requirements_stage.go) dedups by exact name chromium, so a skill declaring google-chrome or chromium-browser as a bin plus the browser capability installs two browsers. Dedup against known chromium aliases.
• Orphaned profile sweep. Throwaway .forge-browser-* user-data-dirs under WorkDir leak on SIGKILL (Manager.Stop never runs). Sweep stale ones at Manager init.
• PolicySummary criticals count. PolicySummary (forge-skills/analyzer) folds Critical violations into Errors but has no separate Criticals count; a distinct field would make audits clearer.

Context

Untracked minors from the PR #260 review. None blocks the PR.