feat(browser): split EXTRACT by content format so dispatch cannot swap HTML for text (#13236)

[mrveiss]

Closes #13236

Partial — #13236 must stay OPEN. The close keyword is required by the
Validate PR issue link gate; merging to Dev_new_gui does not auto-close.
No caller is migrated — this closes the last contract gap blocking
migration. Steps 2–5 and #13204 remain.

Thinking Path

The fourth gap the real callers exposed, and the only one that would have
produced a silent regression rather than an error.

A single EXTRACT capability meant "return the page's text/markup". That
conflated three different outputs, and the three stacks each produce a
different one:

stack	call	returns
container	render	HTML
worker	get_text	text, markup stripped
in-process	extract_content()	text + structured

web_fetch/_fetch_playwright needs HTML — it feeds a parser. Both the worker
and the container declared EXTRACT and OUT_OF_PROCESS, and register_all
registers the worker first. So migrating web_fetch onto the interface
would have resolved to the worker and returned text.

Nothing would have raised. Text is a valid BrowserResult.content, so the
parser would simply have received the wrong thing — the failure mode that
only shows up as bad output much later.

What Changed

EXTRACT → EXTRACT_TEXT / EXTRACT_HTML / EXTRACT_STRUCTURED. Each
backend now declares what it actually returns rather than that it "extracts".

ExtractRequest.format (a new ContentFormat, defaulting to TEXT).

The two are tied together. Requiring a capability at get_browser time
and naming a format on the request are separate statements that can disagree,
so Browser.extract checks the resolved backend declares
FORMAT_CAPABILITY[request.format] and raises UnsupportedFormatError rather
than returning the wrong shape.

ADR-009 amended in the same commit, not left to drift — it still
documented the single EXTRACT, and its step order nominated content_reach
as the first migration. The audit showed that is wrong: content_reach is the
caller with the most stack-specific behaviour (structured extraction plus
blocked_by_guard handling). web_fetch is the correct first migration, and
the amendment says so.

A fifth gap, found by checking the contract end-to-end

After the split I checked whether web_fetch could actually be served, and it
still could not. _fetch_playwright sends
timeout: int(timeout * 1000) to the render endpoint, but ExtractRequest
had no timeout field — NavigateRequest and ScreenshotRequest both do,
so it was the odd one out — and container.extract sent no timeout at all.

Migrating would have silently dropped the caller's timeout and fallen back to
the container default. ExtractRequest.timeout_seconds now exists, the
container converts to the milliseconds its endpoint expects, and omits the key
entirely when the caller passes None so the container default still applies
rather than timeout=0.

Verification

autobot_shared/browser + autobot-backend/browser_backends   46 passed  (was 36)
bandit                                                       0 issues
isort · black --line-length=120 · flake8                     clean

The load-bearing test uses the real backends under the real
registration order:

register_all(force=True)
chosen = await resolve_backend({Capability.EXTRACT_HTML, Capability.OUT_OF_PROCESS})
assert chosen.name == "container"   # not "worker", which registers first

The others pin that a mismatched format raises before the backend is
reached (asserted against its call log), that every ContentFormat maps to a
capability so a new format cannot KeyError at dispatch, and that each
stack's declared formats match what its code actually returns.

I also checked no bare Capability.EXTRACT survives anywhere, including the
package docstring example — grep clean.

What this does not do

• No caller migrated. Still additive.
• security(browser): send_to_browser_vm and playwright_service bypass the SSRF/DNS-rebind guard the other browser paths enforce #13204 untouched — it closes only with the tool_handler migration.
• Step 2 (web_fetch) is now genuinely unblocked and behaviour-preserving:
  {EXTRACT_HTML, OUT_OF_PROCESS} resolves to the container — exactly what
  _fetch_playwright calls today — and its timeout survives the move.

Model Used

Claude Opus 5 (1M context)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!