feat(browser): fixed Windows identity and per-site egress in umt-cookies plugin (BR-4)

- browser:launching hook generates a Windows fingerprint once (camoufox-js,
  os=windows), persists it to /root/.camofox/umt-identity.json and reuses it
  on every launch; Firefox/Camoufox upgrades only bump UA/version fields
- Windows fontconfig with absolute font dir (upstream path was broken)
- GET /umt/identity (public UA/OS/version) and PUT /umt/sessions/:id/proxy
  (per-context proxy; Firefox no longer uses container HTTP_PROXY env)
- adapter identity()/setEgress(), splitBrowserOnlyCookies for cf_clearance/__cf_bm

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/adapters/src/browser/provider.ts

@@ -2,7 +2,9 @@ import type {
   BrowserCapabilities,
   BrowserControlLease,
   BrowserCookie,
+  BrowserEgressProxy,
   BrowserHealth,
+  BrowserIdentity,
   BrowserLeaseHolderKind,
   BrowserProviderKind,
   BrowserSession,
@@ -90,6 +92,15 @@ export interface BrowserProvider {
    * 原有打开中的标签页一律标 lost。不检查控制者(接管中的会话也能重连,控制权不变)。
    */
   reopenSession?(sessionId: string, req: ReopenSessionRequest): Promise<ReopenSessionResult>;
+
+  // ── BR-4 浏览器 UA 与指纹统一、出口按站点 ──
+  /** 固定浏览器身份的公开部分(UA、OS、版本);上游没有时返回 null */
+  identity?(): Promise<BrowserIdentity | null>;
+  /**
+   * 该 profile 的出口:proxy = 站点开代理时与 HTTP 同一代理,null = 直连。上游没有接口时报 BrowserError("not_implemented")。
+   * restarted = 活动上下文出口不同、已被关闭(下次操作按新出口重建)。
+   */
+  setEgress?(profileKey: string, proxy: BrowserEgressProxy | null): Promise<{ restarted: boolean }>;
 }
 
 export interface ReopenSessionRequest {