browser_vault_fill / enter_code / save_login reach the page over the supervisor CDP socket, outside
_run_browser_command, so they skipped the Bot Desktop fence: with a human holding the screen an ordinary
browser_snapshot was refused while enter_code focused, inspected and wrote to the very form the human was
typing into. Their tool handlers now run under the same run_fenced admission + epoch check as every other
page access.
e1fd8f5dde