fix(cli): update Puppeteer browser dependencies

[heygengenesis]

What

Fixes #4028.

Update the CLI manifest from @puppeteer/browsers ^3.2.1 to ^3.2.2 and puppeteer-core ^25.8.0 to ^25.10.0. The CLI has no direct puppeteer dependency.

Why

The upstream basis, not proof for this repository, is Puppeteer PR #15415, commit a84b0325de0e860c9c4b60de7bff7c0ae100accd, released in @puppeteer/browsers 3.2.2. The upstream “fixed in 3.2.2” claim is explicitly UNVERIFIED for the reported console-window symptom in this repository.

How

This branch was rebased onto main at f92d017b999d26b14c49a8439dc16d2e476bffde. The frozen lock resolutions now select @puppeteer/browsers 3.2.2 and puppeteer-core 25.11.0 for the CLI's ^25.10.0 range. The lockfile was regenerated with Bun 1.4.2; it also refreshes stale workspace metadata from 0.8.50 to 0.8.57 and records the transitive devtools-protocol 0.0.1666840 → 0.0.1680125 and webdriver-bidi-protocol 0.4.2 → 0.4.3 resolutions. Existing puppeteer@25.8.0 consumers retain their nested legacy graph.

Manifest evidence: @puppeteer/browsers L34 and puppeteer-core L48. Lock evidence: @puppeteer/browsers L1056 and puppeteer-core L1904.

Reviewer advisory: only the CLI manifest ranges changed. The regenerated shared lock resolution is not a runtime-test claim for any other workspace.

Test plan

• bun install --lockfile-only passed with Bun 1.4.2.

• bun install --frozen-lockfile --ignore-scripts passed and left bun.lock unchanged.

• bunx oxfmt --check packages/cli/package.json, bun run --cwd packages/cli typecheck, and the targeted browser tests (58 tests) passed.

• bunx fallow audit --base origin/main --fail-on-issues passed; no reductions found.

• The upstream “fixed in 3.2.2” claim remains explicitly UNVERIFIED for the reported console-window symptom. A Linux sandbox cannot perform a Windows visual/native-console repro.

• Render on windows-latest is required on this new head. Its green result proves only that the Windows install/build/render path launches and completes at the updated version; it does NOT observe or enumerate the reported 78 console windows, window visibility, or focus. A human on Windows must confirm the symptom is gone before merge.

• Unit tests added/updated — dependency and lock-only change.

• Manual testing performed — lock regeneration and dependency-resolution validation.

• Documentation updated (if applicable) — not applicable.

[miguel-heygen]

Superseded by #4233 (same manifest bump, lock regenerated on current main), merged as e86a530.

[miga-heygen]

Superseded by #4233, which carries the identical manifest change (@puppeteer/browsers ^3.2.1 -> ^3.2.2, puppeteer-core ^25.8.0 -> ^25.10.0) and merged at 22:08:17Z. Nothing is outstanding here and this does not need reopening.

One thing did not travel with the supersede: the open question of whether the bump actually removes the stray console windows on Windows. CI observes that the render path launches and completes, which is a different observation. That confirmation is still unmade against main.

— Miga