EPIC: Web panes → WebContentsView — replace <webview>, fix browser breakage

[kordless]

Why

Web panes render with Electron's deprecated <webview> tag (lib/components/web-pane.tsx), which is the root cause of the "some pages break" reports: Cloudflare/bot walls, OAuth popup handoffs, render glitches, black-flash. Migrate to the supported WebContentsView — a native Chromium view the main process positions with setBounds().

Full, code-grounded design (every anchor is a real file:line) lives in plan/webcontentsview-migration.md.

Decisions (locked)

• Straight replacement, no feature flag — few/no users; upgrade over dual-support.
• Overlay occlusion = hybrid — persistent header is inset (view never covers it); transient DOM overlays (URL navigator, find bar, spinner, consent modal) use freeze-and-swap (capturePage() → still image while the overlay is up, restore on close).
• Electron pinned 41.3.0 (WebContentsView available).
• Reuse configureWebPaneSession() verbatim (the Chrome-UA + sec-ch-ua rewrite) — it's session-level.

Phases

• Phase 1 — WebPaneManager foundation (create/bounds/visible/destroy, shared session, state push, window-close cleanup since WebContentsView webContents don't self-destruct). Foundation committed 955c9d92 (dormant); renderer swap next.
• Phase 2 — Navigation + state (back/forward/reload/stop/load; push title/url/loading/canGo*; OAuth + _blank handlers on the owned webContents). Fixes Web pane opened by click/agent is not saved to the chooser URL history #98 (record opening URL on create).
• Phase 3 — executeJavaScript surface + MCP rewire (bg-color, HTTP status, scrollbar CSS, page-read, sticky extract, ghost cursor/click; route web_pane_content/eval/mouse/click/reload straight to webContents, deleting the renderer round-trip).
• Phase 4 — Overlays via freeze-swap (UrlNavigator, FindBar + match counts, spinner, pulse editor, consent modal / agent toasts).
• Phase 5 — Splits + tabs + zoom + DevTools + context menu (per-tab show/hide replacing left:-9999em, live setBounds on split-drag, verify context-menu crash electron#44898, pop-out reparent). Fixes Closing a web pane reverts a sibling web pane to its first page #99 (per-pane persistent view = no remount-to-first-page) and Web pane: right-click → Inspect in a SPLIT (dock DevTools inside the pane, not a detached window) #125 (a real webContents host can dock DevTools in a split — impossible for a <webview> guest).
• Phase 6 — Remove <webview> + webviewTag, drop @electron/remote web-pane usage + dead web-pane-*-result IPC. Full regression.

Rolled up into this epic (closed)

• Web panes: JS-side navigator.userAgentData override for Cloudflare managed challenge #92 — Cloudflare managed-challenge UA override → the migration carries the header/UA work forward and WebContentsView lets us set navigator.userAgentData cleanly on the owned webContents.
• Web pane opened by click/agent is not saved to the chooser URL history #98 — opening URL not saved to chooser history → Phase 2.
• Closing a web pane reverts a sibling web pane to its first page #99 — sibling web pane reverts to first page on close → Phase 5 (structural: main owns the view, React reparent no longer remounts it).
• Web pane: right-click → Inspect in a SPLIT (dock DevTools inside the pane, not a detached window) #125 — Inspect in a split (dock DevTools) → Phase 5 (unblocked by leaving <webview>).

Related (kept open, cross-linked)

• feat(chat): unify Ghost chat as a sidecar-served UI — Electron embeds via webview, browser opens same URL #46 (Ghost chat embed → would become WebContentsView), Track web pane URLs in bridge for layout capture #84 (web-pane URL tracking for layout capture, dovetails with Phase 2 URL persistence), Tool discoverability: open_web_pane mis-names a tab as a 'pane', web-pane-in-tab is hidden in terminal_split, terminal_status gives no action hints #120 (open_web_pane tool naming).

Work lands on canary.