[Ji-One1]

The buyer needs a fresh guest browser whose lifetime and navigation controls belong to the harness, not the agent SDK.

What this changes

• Launch an owned headless Chromium process with a temporary profile. Resolve an explicit executable, an environment override, or a known local installation.
• Install browser-wide document interception before page loading. Apply the preceding checkout/account policy to tabs, popups, frames, and redirect hops.
• Stop the browser if the policy connection fails or a request cannot be blocked.
• Record the first checkout block outside an embedded frame as a handoff diagnostic, including its raw URL. Keep embedded checkout frames blocked without treating them as a handoff. Capture does not itself stop the buyer.
• Install the preceding Standard Event recorder with the selected names; default to none.
• Add bounded browser/profile cleanup and a screenshot helper that can save a supplied SDK PNG.
• Add the integration-test script and local browser fixtures.

Developer impact

Internal tooling only; no published Hydrogen changes or changeset. Chromium must be installed or configured. This is the browser layer, not the buyer CLI.

Risk

Document interception is not a block on all network traffic. Raw checkout URLs and unmasked screenshots are private owner data. Browser country and language are not read or monitored.

Stack: 09/15. Previous: #4316. Next: #4318.