Route QM browser tasks through Aside Remote Control

[time-attack]

Summary

• bake the official pinned, checksum-verified Aside CLI into Fly, Porter, and E2B agent images
• add a DM-only aside-browser skill with host selection, secure sign-in, Guard-mode execution, session continuation, and disconnect flows
• prefer an already-connected Aside Browser before paid provider browsers without forcing setup
• let a personal secret drop explicitly grant its automatic resume one-time access, preserving the existing no-grant default

Verification

• npm run typecheck
• npm run lint
• npm run lint:ox
• npm run format:check
• Aside integration, secret-drop, seed-skill, and sandbox-image tests: 39/39 passed
• full root suite: 5,611 passed; two unrelated timing failures passed together on immediate standalone retry (23/23)
• live Remote Control smoke test: selected an enabled online Mac, ran a real aside exec --host ... task against Example Domain, and resumed the same session successfully
• independent security/correctness review: clean

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}