#4414 fix(web): scope implicit browser sessions to workspaces

Summary

Implicit web sessions use the existing workspace scope for distinct browser devices. Named and tenant sessions retain their keys. Fixes #4233.

Eleven files changed, including router coverage, versioned help, session and command documentation, and ADR 0037. Scope expanded to keep the command reference and help consistent. #4384 and #4396 also edit request-execution-scope.ts in separate sections. #4410 edits the Apple portion of device.ts.

Validation

• Base eb4fede234: the router regression fails because the second workspace receives DEVICE_IN_USE for p_default.
• Head e86dc1849f: pnpm check:affected --run --head e86dc1849f passed; receipt run-1A7DCf, exactCommit: true.
• Live agent-browser evidence: two workspaces opened and snapped simultaneously, workspace A reused its ID, a second daemon was refused the shared claim, and explicit default used p_default. All sessions and both isolated daemons were closed. The run used the production code at fe498648a6; the later commits refine the workspace identity and its tests; the observed backend key and claim behavior remain the same.
• CI owns integration and coverage at the current head. No independent reviewer was available; the diff was self-reviewed.

🤖 Generated with Claude Code