test: replace product tests that fake the product with real-boundary tests (F)

- design: serve.test.ts drove an inline mirror server; now two tests run the
  real serve() on an ephemeral port (reload confinement, submit exit 0).
- setup-gbrain: rollback + voyage tests execute the template-extracted init
  blocks (3 sites) instead of drifted local bash copies.
- terminal-agent: internalHandler source greps replaced by a behavioral
  /internal/grant + /internal/revoke auth matrix (no/wrong/valid token).
- /health: server-security-surface and the server-auth / security-audit-r2 /
  sidebar-tabs source greps fold into one liveness-only check on the real
  body; the L4 sidecar wiring gets a behavioral /pty-inject-scan test.
- delete tautologies (browser-manager onDisconnect, memory-command #12),
  ios swiftui tap fixture self-check, memory-ingest put_page grep, detach
  source greps, sidebar-agent absence pins, dead-CSS pins + the dead CSS,
  security-audit-r2 Task 1 + the test-only meta-commands re-export,
  duplicate generated-SKILL.md checks.
- make-pdf coverage-gaps cases move into their owner test files.

browse/test/sidebar-tabs.test.ts

@@ -198,19 +198,6 @@ describe('server.ts: chat / sidebar-agent endpoints are gone', () => {
     expect(SERVER_SRC).not.toMatch(/^interface ChatEntry/m);
     expect(SERVER_SRC).not.toMatch(/^interface SidebarSession/m);
   });
-
-  test('/health no longer surfaces agentStatus or messageQueue length', () => {
-    const health = SERVER_SRC.slice(SERVER_SRC.indexOf("url.pathname === '/health'"));
-    const slice = health.slice(0, 2000);
-    expect(slice).not.toContain('agentStatus');
-    expect(slice).not.toContain('messageQueue');
-    expect(slice).not.toContain('agentStartTime');
-    // chatEnabled is gone entirely — the chat pane no longer exists in any
-    // extension build, so /health stopped advertising a chat mode.
-    expect(slice).not.toContain('chatEnabled');
-    // terminalPort survives.
-    expect(slice).toContain('terminalPort');
-  });
 });
 
 describe('cli.ts: sidebar-agent is no longer spawned', () => {
@@ -240,17 +227,6 @@ describe('cli.ts: sidebar-agent is no longer spawned', () => {
   });
 });
 
-describe('files: sidebar-agent.ts and its tests are deleted', () => {
-  test('browse/src/sidebar-agent.ts is gone', () => {
-    expect(fs.existsSync(path.join(import.meta.dir, '../src/sidebar-agent.ts'))).toBe(false);
-  });
-
-  test('sidebar-agent test files are gone', () => {
-    expect(fs.existsSync(path.join(import.meta.dir, 'sidebar-agent.test.ts'))).toBe(false);
-    expect(fs.existsSync(path.join(import.meta.dir, 'sidebar-agent-roundtrip.test.ts'))).toBe(false);
-  });
-});
-
 describe('manifest: ws permission + xterm-safe CSP', () => {
   test('host_permissions covers ws localhost', () => {
     expect(MANIFEST.host_permissions).toContain('ws://127.0.0.1:*/');