fix(runtime): self-recover browser after Human teardown

[git-ksk]

Summary

Implements #189 without moving Cloud Run/process ownership into Handoff.

• reconstructs the Maps-owned automation Chrome/CDP inside the same service instance after recoverable connection loss;
• only connection failures explicitly marked reconstruct_browser trigger self-recovery; structural fail-closed BROWSER_UNAVAILABLE cases such as multiple Maps tabs remain untouched;
• expired explicit Human sign-in surfaces are revoked/cancelled only for the same authenticated principal before reconstruction;
• explicit Human cancel reconstructs a fresh automation browser/CDP and does not checkpoint a signed-in profile;
• recovery clears stale semantic/CDP state and never resumes or replays the failed MCP action;
• same dedicated profile ownership remains fail-closed through the existing SystemBrowserCredentialSession.assertProfileUnlocked() boundary;
• docs/roadmap describe same-instance recovery as canonical and Cloud Run revision replacement only as an operational fallback.

Validation

• npm run check: 365 tests / 360 pass / 0 fail / 5 platform skips
• reference OAuth gateway: 40/40
• npm run build
• git diff --check

Remaining acceptance

• Cloud Run-equivalent same-instance expiry/cancel recovery without creating a new revision
• physical iPhone Safari sign-in acceptance on the combined ops(handoff): pin Cloud Run Human takeover to managed WSS-only policy #181/fix(profile): stage stopped Human profile before fresh Agent verification #183/fix(runtime): self-recover Maps browser/CDP after Human takeover teardown #189 candidate

Closes #189 only after those acceptance gates pass.

[git-ksk]

Cloud Run same-instance recovery acceptance passed on the combined #181/#183/#189 candidate.

Bounded evidence:

• candidate revision: maps-browser-mcp-v044selfrecover
• immutable image digest: sha256:b6f809abdea4a3d30c55c778d9c0116f32fd0d8286f343676ed8694e4bb0e776
• 100% canonical traffic after Ready=True / ContainerHealthy=True
• public-origin OAuth boundary: pass
• public takeover WebSocket boundary: fail-closed pass
• fresh Maps search/readiness: signed_out
• explicit Human sign-in surface was created, then cancelled without opening it
• Handoff recorded session_revoked, authority boundary remained valid
• no Cloud Run revision replacement occurred after cancellation
• immediate fresh maps_search succeeded on the same revision
• no failed MCP action was replayed

Deterministic coverage on the branch remains green: root 370 tests / 365 pass / 0 fail / 5 platform skips on the combined line; reference OAuth gateway 42/42.

Remaining #189 acceptance is the expiry-shaped path and the physical iPhone sign-in run on the same combined candidate. No credentials, account identity, locator, or browser content are recorded here.