Fix two Chromium browser-process crashes (history embeddings CHECK, macOS --single-process)

[goeric]

Summary

The Chromium process rodney manages dies mid-session, after which every command
fails with failed to connect to browser (is it still running?). It turned out
to be two independent Chromium CHECK failures in the browser process, both
caused by launch flags rodney chooses. 33 crash dumps on one macOS machine over
five days; both are fixed here.

Neither is a segfault — EXC_BREAKPOINT/SIGTRAP in the browser process is a
deliberate Chromium abort, so the browser takes itself down and there is nothing
to recover.

Root cause 1 — the field-trial testing config runs unfinished features

FATAL:history_embeddings_service.cc(597)] Check failed:
cached_embedding != embedding_cache.end()

The pinned Chromium (128.0.6568.0, rod revision 1321438) is a development
snapshot, and those builds apply
testing/variations/fieldtrial_testing_config.json by default. That
force-enables features that are still being written. HistoryEmbeddings is one:
it computes passage embeddings on the browser's main thread after each
navigation and CHECK-fails on a cache miss, so the whole browser aborts a few
seconds after a text-heavy page loads.

It needs the on-device model the optimization guide downloads, so it only starts
biting once a profile has been used for a while. That is why a long-lived
~/.rodney profile crashes reliably while a throwaway one looks fine — and why
this presents as "heavy commercial sites kill the browser". The command that
reports the failure is just the next one after the browser already died.

Fix: --disable-field-trial-config, so rodney drives a browser with shipped
defaults rather than whatever was mid-flight when the snapshot was cut, plus an
explicit --disable-features=HistoryEmbeddings because a browser supplied via
ROD_CHROME_BIN can enable it from a server-side variations seed that the switch
does not cover.

Root cause 2 — --single-process on macOS

FATAL:video_capture_device_factory_apple.mm(37)] Check failed: mode.
The MacOS video capture code must be run on a CFRunLoop-enabled thread

--single-process (added for gVisor screenshots, notes/gvisor-screenshots/)
collapses the utility services into the browser process. media/capture's Apple
backend CHECKs that it owns a CFRunLoop-enabled thread, which only holds when
video capture has a utility process of its own.

Deterministic, one command on macOS:

rodney open https://example.com/
rodney js "navigator.mediaDevices.enumerateDevices().then(d=>d.length)"
# before: browser gone. after: 3

Device enumeration is routine in the fingerprinting scripts commercial sites
ship, which is what makes it look load-related. gVisor is a Linux sandbox, so
skipping the flag on Darwin costs nothing; Linux and Windows are unchanged.

This overlaps #45 by @flgusto, which reached the same flag from crash
reports. It is included so the branch is a complete fix — drop commit 2 if #45
lands first.

The two are independent

Fixing only --single-process still crashes: with the flag already absent, a
profile that reproduces root cause 1 died 3/3 runs. Both fixes are needed.

Verification

Against a copy of a profile that reproduces the crash, driving real commercial
sites:

	before	after
history_embeddings CHECK (real profile)	died 3/3	survived 4/4
enumerateDevices() probe (macOS)	died 2/2	survived 3/3
end-to-end browse loop, 75 commands	new crash dump 2/2	none 2/2
soak: 240 commands / 48 page loads	—	alive, 0 new crash dumps

Crash sites were confirmed two ways that agree exactly: symbolizing the .ips
dumps by disassembling the stripped framework at the faulting return address to
recover the embedded __FILE__/condition strings, and then capturing the same
FATAL: lines live on stderr from a reproduced crash.

go build, go vet and the full go test ./... suite pass. Five unit tests
cover the flag selection, including that --disable-features accumulates rather
than clobbers what rod and configureExtensions already set.

(Independent of #52 — these flags are on main and the earliest dumps predate
that branch.)

🤖 Generated with Claude Code