Open browser links beside their source (#32907)

* Open links beside their source and reuse matching browser pages

- Preserve source-group placement across terminal, chat, file, and runtime links
- Add explicit “Open in this group” actions with safe refusal handling
- Match browser pages by host, session, resource, and exact page identity

* Preserve file link ownership when opening beside source

* Isolate browser link sessions by workspace profile

* Wait for browser tabs to render before activating links

* Respect explicit group requests when opening detected files

* Preserve legacy link ownership when opening browser tabs

* Clean up unactivated browser tabs after failed link opens

* Reveal routed browser links without stealing focus

* Preserve browser profile reuse and foreground ownership during link open

* Prefer visible browser panes and reuse exact link destinations

Reuse matching pages within the same workspace, execution host and browser
profile. Otherwise open in the focused or most recently used visible browser,
or create a split beside the source when no browser is visible. Keep explicit
group placement and background/focus ownership protections.

Incorporate visible-browser selection and popup routing from #22686 into
#32907, including selector regression coverage.

Co-authored-by: Luca Critelli <lucacri@gmail.com>

* Route browser links by workspace without reading global focus

* Validate SSH browser ownership before opening links

* fix branch file size limit

* fix(ci): track extracted browser link ratchet entries

* fix(test): follow source-aware browser link opening

---------

Co-authored-by: Luca Critelli <lucacri@gmail.com>

docs/site/content/docs/browser/overview.mdx

@@ -18,7 +18,7 @@ Every Orca worktree has its own browser. It's a real Chromium window — address
 - `Cmd-F` — find in page.
 - `Cmd-T` — new tab, scoped to this worktree.
 - `Cmd-Shift-T` — reopen last closed tab.
-- Page links that use `target=_blank` and ordinary unnamed popups open in new Orca tabs, using the opener tab's browser profile. Named or OAuth-style popups can still open in a separate window.
+- Page links that use `target=_blank` and ordinary unnamed popups open in new Orca tabs in a visible browser pane when available, using the opener tab's browser profile. Named or OAuth-style popups can still open in a separate window.
 
 ## Worktree scoping
 
@@ -36,6 +36,8 @@ For SSH workspaces, **Browse through SSH workspace hosts** controls whether brow
 
 Under [Settings → Browser → Link Routing](/docs/settings), choose whether http(s) links from the terminal, markdown, and editor open in Orca's per-worktree browser or the system browser.
 
+Links opened in Orca first reuse an existing page for the exact destination in the same workspace, execution host, and browser profile. Otherwise, they open a new tab in a pane already showing a browser. When several browser panes are visible, the focused one wins, then the most recently used one. Browser tabs hidden behind other tabs do not attract new pages. With no browser visible, a new split opens beside the source pane, keeping its contents visible. Explicit **Open in this group** actions use the requested pane instead.
+
 A nested **Hold Shift…** toggle inverts that default for one click with the platform modifier (`⇧⌘-click` on macOS, `Shift+Ctrl+click` on Windows / Linux):
 
 - When links open in **Orca**, the modifier sends one link to the system browser.