fix(omnio): harden conversation browser sessions

[ppazosp]

Summary

• resolve Omnio CDP endpoints and Toolbox recovery by stable conversation/session identity
• prevent Hermes cleanup from sending Browser.close to provider-owned Chrome processes
• route page-scoped raw CDP commands safely and recover browser-vision failures consistently
• make API sessions eligible for authenticated background completion wakeups without pretending they support direct push
• treat background-job exit markers/logs as authoritative and tolerate transient backend polling failures
• expand ~ inside the Sprite rather than against the gateway host

Why

The affected traces combined cross-chat browser ownership bugs with Hermes-side cleanup, recovery, raw-CDP, background-job, and sandbox path assumptions. These changes consume Omnia's per-conversation browser contract and remove the remaining paths that could kill another chat's browser or report false environment failures.

Verification

• focused browser/gateway/process/path suite: 312 tests passed
• broader relevant regression sweep: 817 tests passed across 46 files
• Ruff and git diff --check passed
• the all-repository suite reached 66% with 32,523 passing tests before being stopped; its 20 failures were unrelated local-environment/baseline failures, including missing optional acp collection dependencies and macOS path/systemd assumptions

Backward compatibility

Backward compatible. New Hermes prefers the additive session-templated CDP contract but falls back to the existing static endpoint with old Omnia; old Hermes continues to work against new Omnia through that legacy endpoint. Existing adapters that do not declare the new push-delivery capability retain their prior behavior, and no persisted-data migration is required.

[ppazosp]

Superseded by native GitHub Stack NousResearch#56: #54 → #55 → #53. The top of that stack is byte-for-byte equivalent to this PR, with each concern now independently reviewable and verified at its branch boundary.