fix(t3): automate Linux browser host setup

Merged
SH
22d ago
+190-4

Linux T3 hosts previously required an operator to run browser setup before Chrome's sandbox could start. Enabled Linux hosts now run T3's idempotent browser setup after managed npm installation and during the existing connect reconciliation, so libraries needed after the first browser download are checked again.

The helper uses the active service CLI, preserves the invoking user's T3 home and PATH, runs directly as root, and uses noninteractive privilege escalation for other users. Missing installations defer to the connect timer; setup failures propagate. macOS and hosts with T3 disabled are excluded. Chrome's sandbox stays enabled, and this PR adds no privilege policy.

decided: reuse one helper from activation and the existing connect timer - covers initial provisioning and later browser downloads without another service.

Validation:

  • Focused ShellSpec: 79 examples, 0 failures, 1 existing /proc cache-pruning test skipped on macOS. GNU coreutils and flock supplied for the Linux-oriented runtime tests.
  • Coverage manifest and browser setup checks after registering the script: 144 examples, 0 failures. GitHub shell-test and shell-check passed on the corrected head.
  • ShellCheck, Nix formatting, and make shell-inline-check passed.
  • Evaluated the generated Kamino activation dependency and connect-service environment; verified browser activation is absent for a disabled worker and macOS.
  • Admin-merged at 25fb359544e268bfd86d421f818d1ce1be53ef40 with operator authorization. Some aggregate GitHub checks remain pending.

Provisioning: installed the generated T3 configuration from the merged commit on all eight enabled Linux hosts. Verified the canonical files, active T3 services and timers, enabled sandbox setting, successful repeated browser setup, and environment endpoints returning HTTP 200. The four hosts whose declared policy disables T3 retain inactive services and timers. Deployment packages are pinned in the Nix store with prior managed links backed up. This was a focused T3 rollout, not a full host configuration switch.

Chrome remains a first-use download on four enabled hosts. Setup and timer wiring are verified there; an actual first browser launch and its library readiness are not yet proven.

Upstream command behavior: T3 browser host setup.