Egress: attribute browser (chromedp) proxy audit events to task/invocation

[initializ-mk]

Problem

Follow-up to #338 / PR #339. That PR attributes subprocess egress-proxy audit events (egress_allowed / egress_blocked with "source":"proxy") to their task_id + correlation_id by stamping the IDs into the HTTP_PROXY userinfo, which HTTP clients replay as a Basic Proxy-Authorization header. This covers the two HTTP_PROXY-injecting executors (SkillCommandExecutor, CLIExecuteTool).

The browser is the one remaining subprocess egress path and it is not covered: browser egress proxy events still emit with no task_id / correlation_id.

Why the #338 mechanism doesn't apply

The browser doesn't use the HTTP_PROXY env var. Chrome is pointed at the egress proxy via chromedp's --proxy-server flag:

forge-cli/tools/browser/manager.go:103
    chromedp.ProxyServer(m.cfg.ProxyURL),

Two blockers:

1. No userinfo replay. Chrome does not turn proxy-URL userinfo into a preemptive Proxy-Authorization header the way curl/Go/Python do. It waits for a 407 challenge and handles auth through the CDP Fetch domain (Fetch.authRequired → Fetch.continueWithAuth), so the identityFromRequest decode on the proxy side never sees credentials.
2. Shared proxy, many sessions. A single EgressProxy serves every browser session, so even a static credential couldn't distinguish which task a given request belongs to without per-request or per-session identity.

Options

• CDP Fetch auth injection — enable Fetch in the browser session and answer authRequired with Basic base64(b64url(task):b64url(corr)) per session, so Chrome sends the same Proxy-Authorization the exec path stamps. Reuses the proxy-side decode unchanged. Most consistent with Egress: subprocess proxy audit events missing task_id / correlation_id #338.
• Per-invocation proxy listener — bind a dedicated proxy port per task with the identity baked in; Chrome points at that. Heavier (one listener per active browser task) but tamper-proof and needs no CDP auth dance.
• CDP request interception — attribute via Network/Fetch request metadata inside the browser manager rather than at the proxy, emitting the audit event from the manager (which has the task ctx) instead of the proxy OnAttempt.

Acceptance criteria

• Browser-originated egress_allowed / egress_blocked ("source":"proxy") carry task_id + correlation_id.
• Graceful fallback preserved (no attribution rather than a hard failure if the mechanism can't run).
• No credential leak to upstream (same invariant as Egress: subprocess proxy audit events missing task_id / correlation_id #338).

Files

• forge-cli/tools/browser/manager.go — chromedp proxy wiring (ProxyServer)
• forge-core/security/egress_proxy.go — identityFromRequest (reused if the CDP-auth option is chosen)