browserrot: Node stealth sidecar + AI self-heal (M-B1..M-B3, LIVE-VM)

Extends the Phase A-tier-1 site-side rotation engine with an optional Node
browser-sidecar and a deterministic self-heal tier, all proven LIVE-VM against
the local lab change-password form. go-rod stays the default; the sidecar is a
swap-in Driver behind the same Session/Driver/Rotator interfaces — no spine
change, backup + verify-new-before-revoke-old + proof gates all apply unchanged.

M-B1 sidecar parity: internal/browserrot/sidecar/ (index.js JSON-RPC over stdio,
  patchright real-fingerprint Chromium, playwright-core fallback) + sidecar.go
  Driver/Session. A shared test harness runs go-rod and the sidecar through the
  identical live rotation proof.
M-B2 stealth: patchright removes navigator.webdriver; humanized input (Bezier
  mouse paths + per-key typing jitter, no ML trajectory generation per plan §5).
M-B3 self-heal: Healer interface + heal-retry fill/click/text wrappers; on a
  rotted selector, heal.js relocates the field from DOM structure ONLY (never a
  value) and the engine rewrites + persists the recipe (recipes.go RecipeBook)
  so the next run is Tier-1 again. Deterministic heuristic is the proven Tier-2;
  Stagehand LLM strategy is opt-in + UNPROVEN. Leak-check asserts no secret ever
  reaches a heal request (redacted IPC transcript).

Secret seam documented honestly: fill carries base64 secret bytes across exactly
one local stdio boundary, typed and wiped, never logged/persisted/sent to a
model. MFA/CAPTCHA still degrade to the human worklist (Hard Rule 5).

14 tests green, -race clean; lab/lab-provision-browserrot.sh proves both drivers.
M-B4 (first REAL self-owned site) deliberately NOT started — needs per-credential
authorization (safe-candidate ladder).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/BROWSER-ROTATION.md

@@ -322,6 +322,29 @@ adapter is pure-exec Go, so it is unit-validated cross-platform via an injected
   wiring auto-enables it yet (still gated behind per-credential authorization). Still to do:
   build out the curated selector table for real high-frequency no-MFA sites and measure the real
   success rate before promising anything.
-- **Phase A-tier-2:** Computer-Use / AI-in-browser vision fallback for DOM variance, with
-  **secrets kept out of the model loop** (the model decides navigation; the Go harness injects
-  the actual password via CDP, redacted from the screenshot stream). Opt-in, measured.
+- **Phase A-tier-1.5 — Node stealth sidecar (built + LIVE-VM):** an optional swap-in
+  `Driver` (`internal/browserrot/sidecar.go` + `internal/browserrot/sidecar/`) that speaks
+  newline-delimited JSON-RPC over stdio to a small Node program driving a **patchright**
+  real-fingerprint Chromium. go-rod stays the default; the sidecar reaches **parity** through
+  the *identical* LIVE-VM harness (`runLiveRotationProof` runs both drivers —
+  `TestIntegration_sidecarBrowserRotation`). Stealth posture is **LIVE-VM**: patchright
+  removes `navigator.webdriver` (`TestIntegration_sidecarStealthSignals`), and humanized input
+  (cubic-Bézier mouse paths + randomized per-key typing, **no ML trajectory generation**) still
+  lands a real rotation (`TestIntegration_sidecarStealthRotation`). The secret seam is honest:
+  `fill` carries the vault bytes **base64** over ONE local stdio boundary, never logged, never
+  on disk, never to a model (`TestSidecar_secretSeamBase64` + a redacted IPC transcript).
+- **Phase A-tier-2 — self-heal + recipe persistence (built + LIVE-VM for the heuristic
+  strategy):** on a Tier-1 selector miss the engine calls an optional `Healer` (a Session
+  capability) to relocate the field by **natural-language description**, retries, and rewrites
+  the recipe; `RecipeBook` (`recipes.go`) persists the healed `Site` so the next run is Tier-1
+  again ("learn once"). The `Heal` signature takes only a description — a secret **cannot**
+  reach the healer by construction (`TestHeal_engineRetriesRewritesAndPersists`,
+  `TestIntegration_sidecarSelfHeal` with a redacted-transcript leak-check). The sidecar's
+  **deterministic DOM-heuristic** heal (attributes/labels/aria only, never field values) is the
+  **LIVE-VM-proven** Tier-2; the **Stagehand `observe` (LLM) strategy** is real but **UNPROVEN**
+  and strictly opt-in (`INCREDIGO_HEAL_STRATEGY=stagehand`) — it needs Stagehand to own the
+  browser, still to be wired. A specific real-site recipe stays **UNPROVEN** until run against
+  that site; no production `rotate` wiring auto-enables it (per-credential authorization).
+- **Phase A-tier-3:** Computer-Use / AI-in-browser vision fallback for hostile DOM variance,
+  with **secrets kept out of the model loop** (the model decides navigation; the Go harness
+  injects the actual password via CDP, redacted from the screenshot stream). Opt-in, measured.