Problem. The agent can navigate to http://localhost (the Seed daemon, dev servers) or LAN admin pages and read them with snapshot. A snapshot is not held to the same-origin rules a normal page is.

Fix. Agent-started navigation refuses loopback, private, link-local and .local hosts, including hostnames that resolve to them. Browser commands also refuse to act on such pages unless the user explicitly allowed that origin.

Branch: feat/integrated-browser