refactor(web-fetch): render through the canonical browser interface (#13236)

[mrveiss]

Closes #13236

Partial — #13236 must stay OPEN. The close keyword is required by the
Validate PR issue link gate; merging to Dev_new_gui does not auto-close.
This is step 2 of 5. Steps 3–5 (content_reach, tool_handler,
api/playwright) remain, and #13204 closes only with step 4.

Thinking Path

The first caller migrated off a directly-named stack, now that the five
contract gaps the audit exposed are closed.

_fetch_playwright imported services.playwright_service directly. It now
declares what it actually needs and lets dispatch resolve it:

requires={Capability.EXTRACT_HTML, Capability.OUT_OF_PROCESS}

Both requirements are load-bearing, not decoration. The worker and the
container both satisfy out-of-process extraction, and register_all
registers the worker first. Under the pre-#13306 single EXTRACT
capability this caller would have resolved to the worker and received
get_text output — plain text where a parser expects HTML, and nothing
would have raised, because text is a valid content value.

That is why this migration went second rather than first, and why the format
split had to land before it.

What Changed

autobot-backend/web_fetch/fetcher.py — _fetch_playwright resolves a
browser by capability instead of importing a stack, and passes its timeout
through ExtractRequest.timeout_seconds.

The inline SSRF check is kept, not deferred to the registry's guard. The
container has network reach to private IPs, so one extra DNS resolution is
cheaper than depending on a single chokepoint — and the docstring now says so,
to stop a later reader deleting it as redundant.

fetch_playwright_interface_test.py — 6 tests.

Verification

autobot-backend/tests/unit/web_fetch
  + tests/test_untrusted_web_content_boundary.py
  + autobot-backend/web_fetch                       186 passed
autobot_shared/browser + browser_backends            46 passed
bandit                                                0 issues
isort · black --line-length=120 · flake8              clean

The tests pin behaviour-preservation rather than just "it runs":

• it lands on the container, the same stack it called before;
• the render payload is unchanged — same endpoint, same wait: networkidle;
• the caller's timeout still reaches the endpoint, in milliseconds;
• the worker is never selected, asserted end-to-end from this caller
  despite it registering first — the exact silent swap this prevents;
• a non-public URL never reaches a backend;
• failure still returns None, so the render cascade falls through to the
  next step rather than propagating.

What this does not do

• security(browser): send_to_browser_vm and playwright_service bypass the SSRF/DNS-rebind guard the other browser paths enforce #13204 is untouched. It closes only with step 4 (tool_handler), which
  is the production behaviour change: the guard starts rejecting internal URLs
  that send_to_browser_vm accepts today. That step needs the existing
  is_url_allowed allowlist call sites enumerated first, and your sign-off.
• content_reach (step 3) is next and now unblocked — BrowserResult.structured
  exists for it.

Model Used

Claude Opus 5 (1M context)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!