test(browse): delete the sidepanel security-DOM suite — it tests UI removed in v1.14

Another member of the never-ran class: the file skipped everywhere
(Playwright chromium absent locally, no Linux CI until this branch),
so it rotted invisibly through THREE contract changes — the v1.63
/extension-token bootstrap, the endpoint growth (/memory,
/pty-session, /sse-session), and finally the v1.14 sidebar-REPL
rewrite that removed the security shield/banner UI it asserts on
(#security-shield survives in sidepanel.html as a dead hidden stub
with no JS driver; sidepanel.js:87 and :1317 document the removal).
The Linux lane executed it for the first time and it can never pass:
the behavior is gone. The L1-L3 security filters it name-checked stay
covered by the ~83 unit/behavioral security tests. The free-tests
lane also vendors xterm assets (bun run vendor:xterm) so the
sidepanel terminal scripts load for any future DOM coverage.

.github/workflows/free-tests.yml

@@ -99,6 +99,12 @@ jobs:
         # Golden-file tests read generated host outputs that are gitignored.
         run: bun run gen:skill-docs --host all
 
+      - name: Vendor xterm assets into the extension
+        # extension/lib/xterm* are gitignored (vendored from npm at build
+        # time). Without them the sidepanel's terminal script bails and the
+        # sidepanel DOM tests time out waiting on init that never happens.
+        run: bun run vendor:xterm
+
       - name: Build server-node bundle (loaded by browse cli imports)
         run: bash browse/scripts/build-node-server.sh