test: cover telemetry/events on control plane + segment-boundary matcher

Adds an integration test (rewrite_direct_vm_options) asserting telemetry/events
stays on the control plane while telemetry/stream routes to the VM, and switches
the stream test env to the full-path 'telemetry/stream'. Addresses review.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: IlyaasK

tests/test_browser_routing.py

@@ -99,7 +99,7 @@ def test_browser_request_uses_curl_raw() -> None:
 
 @respx.mock
 def test_telemetry_stream_routes_directly_to_vm(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", "telemetry")
+    monkeypatch.setenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", "telemetry/stream")
     route = respx.get("http://browser-session.test/browser/kernel/telemetry/stream").mock(
         return_value=httpx.Response(
             200,
@@ -356,6 +356,35 @@ def test_direct_vm_routing_allowlist_segment_boundary() -> None:
     assert _matches_direct_vm_prefix("fs/read", prefixes) is False
 
 
+def test_rewrite_direct_vm_options_keeps_telemetry_events_on_control_plane() -> None:
+    # Integration through the real routing hook: telemetry/events (historical,
+    # control-plane/S2) must NOT be rewritten to the VM, while telemetry/stream
+    # (live SSE) must be.
+    from kernel._models import FinalRequestOptions
+    from kernel.lib.browser_routing.routing import (
+        BrowserRoute,
+        BrowserRouteCache,
+        BrowserRoutingConfig,
+        rewrite_direct_vm_options,
+    )
+
+    cache = BrowserRouteCache()
+    cache.set(
+        BrowserRoute(session_id="sess-1", base_url="http://browser-session.test/browser/kernel", jwt="token-abc")
+    )
+    config = BrowserRoutingConfig(subresources=("curl", "telemetry/stream"))
+
+    events = rewrite_direct_vm_options(
+        FinalRequestOptions(method="get", url="/browsers/sess-1/telemetry/events"), cache=cache, config=config
+    )
+    assert events.url == "/browsers/sess-1/telemetry/events"  # unchanged -> control plane
+
+    stream = rewrite_direct_vm_options(
+        FinalRequestOptions(method="get", url="/browsers/sess-1/telemetry/stream"), cache=cache, config=config
+    )
+    assert str(stream.url).startswith("http://browser-session.test/browser/kernel/telemetry/stream")
+
+
 def test_browser_routing_config_from_env_empty_string_disables_routing(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("KERNEL_BROWSER_ROUTING_SUBRESOURCES", "")
     assert browser_routing_config_from_env().subresources == ()