Harden internal Browser against bot detection

Run Chromium headful through Patchright on a private Xvfb display while keeping Agent Zero's page helpers in Patchright's isolated world.

Reconcile the pinned Patchright package and matching architecture-specific Chromium from Browser plugin hooks so fresh Docker images and self-updated installations converge on the same runtime.

docker/run/fs/ins/install_additional.sh

@@ -99,6 +99,7 @@ DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
   x11-xserver-utils \
   xdotool \
   xauth \
+  xvfb \
   dbus-x11 \
   fonts-dejavu \
   fonts-liberation \

docker/run/fs/ins/install_playwright.sh

@@ -4,13 +4,10 @@ set -e
 # activate venv
 . "/ins/setup_venv.sh" "$@"
 
-# install playwright if not installed (should be from requirements.txt)
-uv pip install playwright
-
 # set PW installation path to temporary Browser runtime storage
 export PLAYWRIGHT_BROWSERS_PATH=/a0/tmp/playwright
 mkdir -p "$PLAYWRIGHT_BROWSERS_PATH"
 
-# install chromium with dependencies
+# preinstall Chromium for fresh images; the Browser hook also reconciles self-updated installs
 apt-get install -y fonts-unifont libnss3 libnspr4 libatk1.0-0 libatspi2.0-0 libxcomposite1 libxdamage1 libatk-bridge2.0-0 libcups2
-playwright install chromium
+patchright install chromium --no-shell