[Narada Code 5] Add Cloud Browser parity to workbench browser CLI

[xTRam1]

Summary

• Extend the workbench environment model with env open --kind cloud plus Cloud Browser adoption and cleanup semantics.
• Keep the M4 browser command family unchanged for cloud sessions: goto, snapshot, find, selectors, click-nrd, fill-nrd, select-nrd, diff, screenshot, and downloads.
• Materialize Cloud Browser downloads into the local proof root without persisting signed URLs.
• Harden scoring/verification so SDK-created cloud sessions need terminal cleanup and env-only roots cannot verify clean.

Validation

• cd /Users/erenerdogan/ZenRep/narada-python-sdk && uv run ruff check packages/narada packages/narada-core packages/narada-pyodide
• cd /Users/erenerdogan/ZenRep/narada-python-sdk && uvx ruff@latest format --check --diff packages/narada packages/narada-core packages/narada-pyodide
• cd /Users/erenerdogan/ZenRep/narada-python-sdk && uv run pytest packages/narada/tests packages/narada-pyodide/tests/test_cloud_browser.py
• Result: 155 passed.

Live proof

• SDK CLI Cloud Browser proof root: /tmp/narada-workbench-runs/m5-cloud-browser-cli-final-20260609T134247Z
• SDK command outputs: /tmp/narada-m5-cli-outputs-final-20260609T134247Z
• Harness product-path Cloud Browser proof root: /tmp/narada-e2e-runs/20260610T001710Z-cloudbrowserproductpath-bb578174374f412eb87ebb4549ca06fb
• Final score and verify passed cleanly for the SDK proof root.
• Final harness proof was clean and Cloud Browser cleanup was terminated.

Codex sibling refs

• caddie: NaradaAI/caddie#6611
• caddie prior trace/lifecycle work: NaradaAI/caddie#6601, NaradaAI/caddie#6603
• narada-python-sdk prior workbench stack: [Narada Code 1] Add workbench trace materialization verifier spine #146, [Narada Code 2] Harden workbench proof-root verification #147, [Narada Code 3] Add Agent Studio lifecycle workbench CLI #148
• frontend: branch:codex/agent-maker-m5-cloud-browser-parity
• architecture-docs: branch:codex/agent-maker-m5-docs

Notes

• Cloud Browser session/window ids are provenance/control metadata only, not task-success evidence.
• The Narada E2E harness was used only as a DEV product-path backstop; the primary surface under test here is the SDK CLI.