docs: publish browser attach and current component maturity

[abrichr]

What changed

• document Flow's supported attachment to one existing signed-in local Chromium tab
• add the loopback CDP endpoint and exact-tab selection flags to the CLI and configuration references
• document source-time secret handling and the boundary with Capture's Chrome extension prototype
• document idle tab resize and monitor-scale rebaselining with exact per-event viewport evidence
• publish openadapt-capture as the Beta canonical native recorder while keeping its Chrome extension prototype clearly scoped
• align the canonical repository registry and ecosystem page with openadapt-agent Beta
• remove the temporary "Browser reference path is Beta" framing from the documentation home page while retaining the exact evidence boundary
• make docs/published-version-claims.json the one editable managed-runtime artifact source and render the five active version values plus the release commit and archive hashes deterministically

Product truth

Browser launch mode and browser attach mode use the same Playwright recorder, compiler schema, and governed replay path. Attach mode preserves an existing local SSO or 2FA session. An idle tab resize or monitor move records a new coordinate baseline and continues. An action that overlaps the transition aborts the recording and publishes no complete metadata.

Capture remains the canonical native recorder for Windows, macOS, Linux, RDP, and Citrix. Its Chrome extension remains a development prototype because it does not yet implement the supported compiler evidence, source-time secret, authenticated event-stream, or governed replay contracts.

Agent is Beta. Its current README and package metadata declare Beta, and its v2 bridge exposes governed Flow bundles through MCP and Agent Skills. The old pre-v2 model-driven wrapper remains deprecated.

The branch is rebased onto Ops main 5c538301bfda27929970f355a88df04e17ac50d8, after PRs #128 and #129. That base corrected all five current managed-runtime references from Flow 1.23.0 to Flow 1.31.0. This branch generates those five outputs and the matching release commit and archive hashes from one structured claim record. A future runtime release updates that record once, runs the renderer, and receives a fail-closed CI check when any value, marker inventory, or marker syntax differs.

Dependencies

• feat(browser): attach recorder to existing sessions openadapt-flow#364 supplies the browser attach, viewport transition, secret, and lifecycle contracts. The documentation requires exact head 2072a4c41d696809154af95441a800317defbd9a or a reviewed successor because older head 0a10f40 did not close the secret/context/finalization races.
• docs: correct stale Capture recorder facts and mark the extension a prototype openadapt-capture#76 supplies the Capture Beta lifecycle and package truth.

Keep this PR as a draft. Do not merge it until both dependency PRs merge, this branch rebases onto their resulting product truth, all exact-head checks pass, and an independent review clears the exact head.

Validation

• uv run pytest tests/ -q — 191 passed
• uv run python scripts/render_published_version_claims.py --check
• uv run python scripts/check_published_version_claims.py --offline
• uv run python scripts/validate_docs.py
• uv run mkdocs build --strict
• git diff --check

[abrichr]

Held — merge preconditions are not met

Reviewed in the docs/lifecycle merge pass. Checks are green at head 7eb9c94, but this stays a draft. Four reasons, in order of weight.

1. Its own stated preconditions are unmet. The PR body says: "Do not merge it until both dependency PRs merge, this branch rebases onto their resulting product truth, all exact-head checks pass, and an independent review clears the exact head." Both dependencies are still open:

• feat(browser): attach recorder to existing sessions openadapt-flow#364 (browser attach) — OPEN
• docs: correct stale Capture recorder facts and mark the extension a prototype openadapt-capture#76 (Capture lifecycle and package truth) — OPEN

2. The Flow dependency is blocked on an unresolved design decision. openadapt-flow#364 is waiting on the founder's choice between three options for declared-secret handling under attach (NEEDS_YOU B33: "browser attach secret redaction does not converge"). Option A changes the mechanism from scrubbing to withholding, and option C ships attach without declared-secret support. This PR documents source-time secret handling for attach. Any of those choices would falsify that documentation, so it cannot be published before the decision lands.

3. It documents behavior no released Flow has. Browser attach, the loopback CDP endpoint, exact-tab selection flags, and idle-resize rebaselining are all #364 behavior. Publishing them on docs.openadapt.ai now describes an unshipped capability rather than what is measured today.

4. It carries a visible maturity label change. openadapt-agent moves Experimental to Beta in repos.yml and the ecosystem table. That is deferred under the one-visible-change-at-the-end rule, even though it aligns the docs site with the org profile, which already publishes Agent as Beta.

Suggested split, if this is wanted sooner

Two parts are independent of #364 and could ship on their own:

• the deterministic version-claim machinery (scripts/render_published_version_claims.py, scripts/check_published_version_claims.py, docs/published-version-claims.json, tests/test_published_version_claims.py, and the marker substitutions). This is mechanism, and it makes the five managed-runtime values fail closed against one source.
• the docs/index.md hunk that removes the "whose reference path is Beta" framing. That removal matches the standing direction against interim "reference path" claims, and the replacement text ("These results qualify only the named tasks and environments") is a statement of what was measured.

Rebase and re-review once #364 and openadapt-capture#76 land.