fix(browse): Xvfb identity is argv[0]'s basename, not a cmdline substring

First Linux CI run: isOurXvfb identified the TEST RUNNER as our Xvfb —
the suite's own argv contains 'xvfb.test.ts', the substring match over
the whole cmdline passed, and the start-time check matched because the
pid was real. Any process whose ARGUMENTS mention xvfb (a runner, an
editor) was killable — the sibling-kill class the identity check
exists to prevent. Identity now rests on argv[0]'s basename ('Xvfb'),
with a sh-$0 regression pin. isDisplayFree falls back to the X
socket/lock files when xdpyinfo isn't installed (x11-utils is absent
on some images that ship Xvfb).

browse/test/xvfb.test.ts

@@ -63,10 +63,28 @@ describe('isOurXvfb (PID validation)', () => {
 
   test('returns false when cmdline does not contain Xvfb', () => {
     // Current bun process is not Xvfb. PID-correct, cmdline-wrong → reject.
+    // NOTE: this very suite's argv CONTAINS "xvfb.test.ts" — a substring
+    // match over the whole cmdline identified the test runner as our Xvfb
+    // on the first Linux CI run. Identity rests on argv[0]'s basename.
     const myStart = readPidStartTime(process.pid);
     expect(isOurXvfb(process.pid, myStart)).toBe(false);
   });
 
+  test('a process whose ARGUMENTS mention xvfb is not ours (argv0 identity)', async () => {
+    // sh's $0 trick plants "xvfb" in the child's args while argv[0] stays sh.
+    // Killing this process because its arguments mention xvfb is the exact
+    // sibling-kill class the identity check exists to prevent.
+    const child = Bun.spawn(['/bin/sh', '-c', 'sleep 2', 'xvfb-lookalike-arg']);
+    try {
+      const start = readPidStartTime(child.pid);
+      // On non-Linux, /proc is absent and both reads return '' → false either way.
+      expect(isOurXvfb(child.pid, start || 'recorded')).toBe(false);
+    } finally {
+      child.kill();
+      await child.exited;
+    }
+  });
+
   test('returns false when start-time differs (PID reuse defense)', () => {
     // Even if we somehow had the right PID, a stale start-time means it's a
     // different process. We never fake the cmdline test, so this assertion