fix: verify tunnel is alive before returning URL to pair-agent

Root cause: when ngrok dies externally (pkill, crash, timeout), the server
still reports tunnelActive=true with a dead URL. pair-agent prints an
instruction block pointing at a dead tunnel. The remote agent gets
"endpoint offline" and the user has to manually restart everything.

Three-layer fix:
- Server /pair endpoint: probes tunnel URL before returning it. If dead,
  resets tunnelActive/tunnelUrl and returns null (triggers CLI restart).
- Server /tunnel/start: probes cached tunnel before returning already_active.
  If dead, falls through to restart ngrok automatically.
- CLI pair-agent: double-checks tunnel URL from server before printing
  instruction block. Falls through to auto-start on failure.

4 regression tests verify all three probe points + CLI verification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

browse/src/cli.ts

@@ -622,6 +622,25 @@ async function handlePairAgent(state: ServerState, args: string[]): Promise<void
 
   // Determine the URL to use
   let serverUrl: string;
+  if (pairData.tunnel_url) {
+    // Server already verified the tunnel is alive, but double-check from CLI side
+    // in case of race condition between server probe and our request
+    try {
+      const cliProbe = await fetch(`${pairData.tunnel_url}/health`, {
+        headers: { 'ngrok-skip-browser-warning': 'true' },
+        signal: AbortSignal.timeout(5000),
+      });
+      if (cliProbe.ok) {
+        serverUrl = pairData.tunnel_url;
+      } else {
+        console.warn(`[browse] Tunnel returned HTTP ${cliProbe.status}, attempting restart...`);
+        pairData.tunnel_url = null; // fall through to restart logic
+      }
+    } catch {
+      console.warn('[browse] Tunnel unreachable from CLI, attempting restart...');
+      pairData.tunnel_url = null; // fall through to restart logic
+    }
+  }
   if (pairData.tunnel_url) {
     serverUrl = pairData.tunnel_url;
   } else if (!localHost) {