feat(browser): delegate MCP/noVNC runtime to rust-browser-connection

[skulidropek]

Summary

Closes #347.

This PR finishes the Rust-only browser/noVNC/MCP integration for docker-git:

• removes the legacy generated docker-git-playwright-mcp / @playwright/mcp wrapper path
• installs the external Rust binaries from ProverCoderAI/rust-browser-connection with an immutable pinned rev: c36f263ebc5d0acdf155113914f08cafefa69c56
• uses docker-git-browser-connection for browser lifecycle startup
• configures Codex, Claude, Gemini, and Grok MCP settings to use browser-connection
• passes --project <project-container> and --network container:<project-container> so MCP and noVNC share the same Rust-managed browser container
• keeps generated shell safe under set -u by falling back from ${DOCKER_GIT_PROJECT_CONTAINER_NAME:-} to hostname

Runtime proof

Fresh local smoke test against /home/dev/rust-browser-connection proved MCP + CDP + noVNC on the same Chromium/X11 session:

• project: dg-rust-browser-smoke-185718
• browser container: dg-rust-browser-smoke-185718-browser
• exact browser container count: 1
• marker/title: MCP_NOVNC_RUNTIME_PROOF_1779649038
• MCP server: browser-connection 0.3.0
• MCP tools observed: browser_navigate, browser_snapshot, browser_evaluate, browser_click, browser_type, browser_press_key, browser_take_screenshot
• MCP browser_evaluate returned the marker from the page title/body
• CDP /json/list returned the same page title/URL
• noVNC WebSocket upgraded successfully and returned RFB 003.008
• X11 framebuffer screenshot visually shows the same marker and text

Local proof artifacts:

• /tmp/dg-rust-browser-smoke-185718-proof/summary.txt
• /tmp/dg-rust-browser-smoke-185718-proof/mcp-verify-stdout.jsonl
• /tmp/dg-rust-browser-smoke-185718-proof/cdp-list.txt
• /tmp/dg-rust-browser-smoke-185718-proof/novnc-rfb.txt
• /tmp/dg-rust-browser-smoke-185718-proof/x11-framebuffer.png

Verification

Local checks after the final fixes:

• bun run typecheck — passed
• bun run test — passed (52 lib test files, 267 tests)
• bun run lint — passed
• git diff --check — passed
• static security scan on staged added lines — 0 findings
• independent pre-commit review — passed; no blocking security concerns or logic errors
• static runtime search: no runtime hits for legacy docker-git-playwright-mcp / @playwright/mcp / old browser runtime files outside negative tests and the implementation plan

Notes

The browser runtime remains in the separate ProverCoderAI/rust-browser-connection repo. docker-git only installs and invokes the published Rust binaries; there is no local Rust source copy or TS browser-runtime duplication in this PR.