feat: route process calls directly to browser VMs

[tnsardesai]

summary

• add process to the default direct-to-VM browser routing allowlist
• cover process exec, spawn, kill, resize, status, stdin, and stdout streaming through the existing prefix matcher
• keep fs/* and telemetry/events on the control plane and preserve the environment override/kill switch

testing

• pytest (678 passed, 2952 skipped)
• ruff check and ruff format --check on touched files
• live browser validation: exec, spawn, and stdout streaming routed through /browser/kernel/process/... and returned the expected output

release

This PR targets next. After merge, release-please opens or updates the versioned next → main release PR. Merging that release PR publishes the PyPI package.

---

Note

Medium Risk
Changes default request routing for all process browser APIs without an env override; misconfigured VMs or prefix edge cases could break exec/streaming until clients adjust KERNEL_BROWSER_ROUTING_SUBRESOURCES.

Overview
Adds process to the default direct-to-VM browser routing allowlist, so browsers/{session}/process/... calls (e.g. exec, nested paths like process/proc-1/stdout/stream) are rewritten to the cached browser VM base URL with JWT query auth—same as curl, computer, and playwright.

fs/* and telemetry/events stay on the control plane; empty KERNEL_BROWSER_ROUTING_SUBRESOURCES still disables routing.

Tests now expect default process routing (prefix matcher, rewrite_direct_vm_options, and integration via Kernel.browsers.process.exec), and process was removed from the “stays on API origin” default test.

^{Reviewed by Cursor Bugbot for commit f833c55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Sayan-]

Verified at f833c55. All 7 public process paths map to matching instance paths, the control-plane handlers have no gating or persistence, 29 tests pass. Method coverage is adequate: process/exec covers routed POST, telemetry/stream already covers routed GET and SSE.

Worth pinning: the fallback replays on any 401/403 carrying a jwt, which is safe only because metro-api rejects in verifySession before reaching the VM and no process endpoint declares 401/403 on the instance. If either changes, a replayed exec double-executes.

Pre-existing: routing.py:263 overwrites a caller-supplied jwt, unlike Node and Go.

The base branch was changed.