Fix local managed AG-UI and isolated-computer smoke path

[arcadegeek23]

Problem

The local OpenBot pilot can show a blank IT Worker computer screen after a browser navigation request. The isolated computer records chrome-error://chromewebdata/ when a task navigates to http://localhost:3010; that address resolves inside the computer container, not to the host OpenBot app.

The IT Worker channel also appeared to receive malformed activity ([object Object]) during the failed run. The configured LangGraph endpoint requires x-openbot-agent-token; the supported managed-agent configuration should inject that header when the OpenBot server is started with the matching managed endpoint environment.

Acceptance criteria

• A fresh local stack started by scripts/start.sh has a managed AG-UI endpoint that accepts a real OpenBot run through the server.
• The endpoint authentication boundary remains enabled; no unauthenticated bypass is added.
• A safe host-reachable test URL is used for isolated computer browser verification instead of host-only localhost.
• A real IT Worker browser action produces a visible result and a corresponding Activity/audit observation.
• Any message/content normalization needed to prevent [object Object] is covered by a regression test.

Scope

Local OpenBot pilot only. Do not modify ARIA/OpenClaw production, customer data, credentials, or the existing unrelated .copilotkit/project.json worktree file.

[arcadegeek23]

Scope update for the local pilot: Kyle approved option 1 to trust the approved Zscaler root CA in OpenBot service containers and supervisor-created isolated browser containers. Implementing opt-in CA propagation only; no TLS verification disablement, broad host access, or private-key handling. The CA will remain outside git and be mounted read-only.

[arcadegeek23]

Implemented and verified the approved CA-trust path in commit cd29751 (fix: make approved CA trust work in Chromium NSS).

• Added Chromium NSS trust bootstrap with libnss3-tools; system trust remains additive.
• Switched supervisor CA injection to structured read-only Docker Mounts.
• Wired OPENBOT_ZSCALER_CA_HOST_PATH through the stock supervisor Compose service.
• Documented the static-service override and retained normal TLS verification.

Verification:

• 207 focused tests passed; agent-computer and supervisor typechecks passed.
• Normal local start path passed service health, migrations, license, server, and app checks.
• agent-bot and agent-langgraph HTTPS fetches returned HTTP 200.
• Static computer and recreated IT Worker both loaded https://example.com through the authenticated browser API with title Example Domain.
• IT Worker was replaced non-destructively on the new image; profile/workspace volume names were preserved.
• NSS CA entry and system CA verification passed; certificate-ignore flags were absent.

No private key, token, certificate contents, TLS bypass, or host exposure was added.

[arcadegeek23]

Follow-up review items are resolved:

• a4f1bc8 validates OPENBOT_ZSCALER_CA_HOST_PATH at supervisor startup instead of failing later per request.
• f95f622 adds entrypoint-level NSS setup coverage with an injected certutil runner and documents OPENBOT_ZSCALER_CA_FILE.

Final focused suite: 208 tests passed, 0 failed; both TypeScript checks passed. The rebuilt image was reconciled onto IT Worker without changing its three persistent volume names. Final HTTPS proof remains HTTP 200 / Example Domain, with NSS present, system CA verified, and no TLS-bypass flags.

Independent correctness and security reviews approve; the maintainability review follow-ups are now closed.