[figitaki]

The original Lightpanda prototype launched the browser inside the broker process environment. This update brings the experiment onto main 794d8642 and replaces that launch path with an externally provisioned, one-shot worker container connected through a private Unix socket.

The worker has no broker credentials or state, accepts one client, and is retired on disconnect, startup failure, crash or expiry. The offline examples use separate network namespaces, no networking, read-only roots, no capabilities and only a dedicated IPC directory. The broker receives no container-runtime or Kubernetes privileges. A startup gate rejects missing CDP document identity or isolated-world semantics instead of falling back to page-controlled evidence.

Main's caller ownership, scoped pending approvals, target binding, per-write authorization and redaction remain in place. SDK cancellation now reaches the fill path and is checked before export and each plaintext CDP write; cancelling a Lightpanda request closes its worker. The browser receives only intended approved field values, never Turnkey credentials or export bundles.

Validation:

• Typecheck, formatting check and broker build pass.
• Full local regression suite: 168 passed, no failures. The dedicated Lightpanda container tests are run separately.
• Pinned Lightpanda 1.0.0 in two separate offline containers: 14 assertions covering real observation semantics, page prototype tampering, mock approval, synthetic injection, redaction, cancellation after approval, wrong target/destination and exclusive attachment.
• Active worker expiry and forced container crash: both invalidate the session and refuse reconnect.
• Unit coverage includes environment allowlisting, malformed/oversized transport frames, private socket permissions, failed attachment, startup crash, cancellation and plaintext-write suppression.

This remains a draft offline experiment: one worker per broker, no pool or reconnect, no Internet browsing configuration, no Kubernetes deployment, and no real-secret setup. Mock approval is not Turnkey quorum. The compatibility gate and these tests are not a browser sandbox audit; deployment controls and any destination egress require separate review. See docs/LIGHTPANDA.md and examples/lightpanda/ for the boundary and reproducible tests.

History preserves the original PR commit as an ancestor, with its in-broker implementation explicitly superseded; the branch update is a normal fast-forward, not a force-push. No merge to main or image publication is included.