test: replace product tests that fake the product with real-boundary tests (F)

- design: serve.test.ts drove an inline mirror server; now two tests run the
  real serve() on an ephemeral port (reload confinement, submit exit 0).
- setup-gbrain: rollback + voyage tests execute the template-extracted init
  blocks (3 sites) instead of drifted local bash copies.
- terminal-agent: internalHandler source greps replaced by a behavioral
  /internal/grant + /internal/revoke auth matrix (no/wrong/valid token).
- /health: server-security-surface and the server-auth / security-audit-r2 /
  sidebar-tabs source greps fold into one liveness-only check on the real
  body; the L4 sidecar wiring gets a behavioral /pty-inject-scan test.
- delete tautologies (browser-manager onDisconnect, memory-command #12),
  ios swiftui tap fixture self-check, memory-ingest put_page grep, detach
  source greps, sidebar-agent absence pins, dead-CSS pins + the dead CSS,
  security-audit-r2 Task 1 + the test-only meta-commands re-export,
  duplicate generated-SKILL.md checks.
- make-pdf coverage-gaps cases move into their owner test files.

browse/test/sidebar-ux.test.ts

@@ -182,43 +182,6 @@ describe('browser tab bar (sidepanel.css)', () => {
   });
 });
 
-// ─── Sidebar CSS tests ──────────────────────────────────────────
-
-describe('sidebar CSS (sidepanel.css)', () => {
-  const css = fs.readFileSync(path.join(ROOT, '..', 'extension', 'sidepanel.css'), 'utf-8');
-
-  test('stop button style exists', () => {
-    expect(css).toContain('.stop-btn');
-  });
-
-  test('stop button uses error color', () => {
-    const stopBtnSection = css.slice(
-      css.indexOf('.stop-btn {'),
-      css.indexOf('}', css.indexOf('.stop-btn {')) + 1,
-    );
-    expect(stopBtnSection).toContain('--error');
-  });
-
-  test('experimental-banner no longer uses amber warning colors', () => {
-    const bannerSection = css.slice(
-      css.indexOf('.experimental-banner {'),
-      css.indexOf('}', css.indexOf('.experimental-banner {')) + 1,
-    );
-    // Should not be amber/warning anymore
-    expect(bannerSection).not.toContain('245, 158, 11, 0.15');
-    expect(bannerSection).not.toContain('#F59E0B');
-  });
-
-  test('tool description uses system font not mono', () => {
-    const toolSection = css.slice(
-      css.indexOf('.agent-tool {'),
-      css.indexOf('}', css.indexOf('.agent-tool {')) + 1,
-    );
-    expect(toolSection).toContain('font-system');
-    expect(toolSection).not.toContain('font-mono');
-  });
-});
-
 // ─── Inspector message allowlist fix ────────────────────────────
 
 describe('inspector message allowlist fix', () => {
@@ -491,11 +454,6 @@ describe('tab switching does not steal focus', () => {
   const serverSrc = fs.readFileSync(path.join(ROOT, 'src', 'server.ts'), 'utf-8');
   const bmSrc = fs.readFileSync(path.join(ROOT, 'src', 'browser-manager.ts'), 'utf-8');
 
-  test('switchTab has bringToFront option', () => {
-    expect(bmSrc).toContain('bringToFront?: boolean');
-    expect(bmSrc).toContain('bringToFront !== false');
-  });
-
   test('handleCommand tab pinning does NOT steal focus', () => {
     // All switchTab calls in handleCommand should use bringToFront: false
     const handleFn = serverSrc.slice(
@@ -1004,41 +962,12 @@ describe('BROWSE_NO_AUTOSTART (sidebar headless prevention)', () => {
 // chat-queue rip (PR #1216) — /command and /batch reset the timer and are
 // covered by that factory suite.
 
-// ─── Shutdown kills the terminal-agent (server.ts) ──────────────
-
-describe('shutdown cleanup (server.ts)', () => {
-  const serverSrc = fs.readFileSync(path.join(ROOT, 'src', 'server.ts'), 'utf-8');
-
-  test('shutdown kills the terminal-agent via identity-based kill (no pkill)', () => {
-    // v1.44+ identity-based teardown: only the PID recorded by THIS
-    // daemon's agent is signaled. The pre-v1.44 `pkill -f terminal-agent`
-    // regex killed sibling gstack sessions on the same host (also pinned
-    // by browse/test/terminal-agent-pid-identity.test.ts).
-    const shutdownFn = serverSrc.slice(
-      serverSrc.indexOf('async function shutdown('),
-      serverSrc.indexOf('try { detachSession()', serverSrc.indexOf('async function shutdown(')),
-    );
-    expect(shutdownFn).toContain('stopAgentByRecord');
-    expect(shutdownFn).toContain('isOurAgent(record, process.pid)');
-    expect(shutdownFn).toContain('readAgentRecord');
-    // No pkill CALL — the word may appear in the explanatory comment, so
-    // match invocation shapes only. The repo-wide reintroduction tripwire
-    // is browse/test/terminal-agent-pid-identity.test.ts.
-    expect(shutdownFn).not.toMatch(/(?:spawnSync|execSync|\$)\(\s*['"`]pkill/);
-  });
-});
-
 // ─── Cookie button in sidebar footer ────────────────────────────
 
 describe('cookie import button (sidebar)', () => {
   const html = fs.readFileSync(path.join(ROOT, '..', 'extension', 'sidepanel.html'), 'utf-8');
   const js = fs.readFileSync(path.join(ROOT, '..', 'extension', 'sidepanel.js'), 'utf-8');
 
-  test('quick actions toolbar has cookies button', () => {
-    expect(html).toContain('id="chat-cookies-btn"');
-    expect(html).toContain('Cookies');
-  });
-
   test('cookies button navigates to cookie-picker', () => {
     expect(js).toContain("'chat-cookies-btn'");
     expect(js).toContain('cookie-picker');