feat: add websocket browser service runtime

Wire the service/browser runtime onto the websocket-driven execution path and add the new browser/service modules needed for the submit flow and runtime integration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/security/mac_policy.rs

@@ -39,6 +39,20 @@ impl MacPolicy {
         Ok(policy)
     }
 
+    pub fn supports_pipe_action(&self, action: &Action) -> bool {
+        let action_name = action.as_str();
+        !self
+            .pipe_actions
+            .blocked
+            .iter()
+            .any(|blocked| blocked == action_name)
+            && self
+                .pipe_actions
+                .allowed
+                .iter()
+                .any(|allowed| allowed == action_name)
+    }
+
     pub fn validate(&self, action: &Action, expected_domain: &str) -> Result<(), SecurityError> {
         let action_name = action.as_str();
         if self