feat(harbor): add Kernel browser control arm

[rgarcia]

Summary

Extend clawbench-harbor-adapt with a Kernel-backed browser runtime so Harbor agents can run ClawBench tasks against one managed remote browser per trial.

• add --browser-runtime kernel with validated runtime options
• create one headful stealth Kernel browser during task setup
• connect the agent's pinned Playwright MCP server through a credential-free local CDP bridge
• finalize and download provider replay recordings during verification
• delete the browser on success and setup failure, then verify deletion
• preserve local Chromium as the default Harbor runtime

Why

The native ClawBench runner supports Kernel browsers after #311, while the Harbor adapter currently supports only container-local Chromium. This adds the corresponding Harbor control arm so the same task corpus can be compared across local and managed browser runtimes without changing task semantics or scoring.

The implementation is rebased on the Harbor correctness changes merged in #324. This PR contains only the remaining remote-browser Harbor integration.

Design

Each generated Kernel task:

1. creates exactly one browser and provider replay during setup
2. stores the provider CDP endpoint in a root-only runtime file
3. exposes a local CDP bridge to Playwright MCP
4. records credential-free session and lifecycle metadata under /my-info/
5. finalizes the replay, writes recording.mp4, deletes the browser, and verifies deletion

The existing local Chromium path remains the default and does not require Kernel credentials.

Validation

• uv run pytest -q — 232 passed
• uv run ruff check src/clawbench tests
• uv run ruff format --check src/clawbench tests
• uv run --frozen pyright src/clawbench tests — 0 errors
• fork CI passes on Ubuntu, macOS, and Windows