Add VisualWebArena benchmark and evaluator

[JeffPengCoder]

What does this PR do?

This is the VisualWebArena follow-up layer above #2917 and, transitively, #2295. It adds only the VisualWebArena-specific pieces:

• a hash-pinned, model-neutral preparation path for the maintained 908-task population and its 346 reference images
• VisualWebArena task-image materialization inside a confined read-only source root
• the image-aware VisualWebArena evaluator and its optional fuzzy-image dependencies
• VisualWebArena verifier routing on the existing webarena_browser local-site resource
• focused source-integrity, image, dataset, evaluator, and configuration tests

It does not restore BrowserGym or introduce a second browser protocol. It reuses the visual-browser runtime, browser-session provider, computer_use actions, agent loop, and distributed process model from #2295, plus the WebArena-family site, login, collision, and evaluator lifecycle from #2917.

Standard workflow

gym eval prepare --benchmark visualwebarena
python benchmarks/visualwebarena/prepare.py --force-env
gym env prefetch --config benchmarks/visualwebarena/env.yaml
gym env start --config benchmarks/visualwebarena/env.yaml

Then, from another terminal:

gym eval run --config benchmarks/visualwebarena/env.yaml --no-serve

The prepare path downloads the public source at the revision recorded in benchmarks/visualwebarena/source_lock.json, validates its SHA-256, exact 908-row denominator, and every local reference image before emitting Gym rows. A real rollout additionally requires a compatible VisualWebArena deployment, reset/isolation policy, site URL environment variables, and judge credentials where the evaluator needs them.

Validation

• gym eval prepare --benchmark visualwebarena: passed and produced 908 of 908 rows from the pinned source
• all 346 referenced task images in that source were validated during preparation
• gym env validate --benchmark visualwebarena: passed
• generated environment composition: resolved successfully
• isolated webarena_browser suite with the VWA layer: 15 of 15 passed
• cumulative Web-focused unit, agent, benchmark, and resource tests after synchronization with current main: 321 of 321 passed
• exact WebArena and VisualWebArena source-lock false positives: passed the repository's detect-secrets hook against the committed baseline
• uv lock --check: passed
• pre-commit run --all-files: passed
• git diff --check: passed

This PR remains a draft until a full VisualWebArena rollout on a qualified deployment is attached. The current evidence proves preparation completeness, image integrity, configuration composition, component behavior, and stack isolation; it is not a new VisualWebArena success-rate result.

Checklist

• I have read the contributing guidelines.
• The change is focused; unrelated repository configuration is excluded.
• Substantive tests cover the new source, image, evaluator, and configuration behavior.
• Standard Gym preparation and environment commands were exercised.
• Pre-commit checks pass locally.
• All commits have DCO sign-off.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.