fix(browser): harden agentic browsing harness against live-observed failures

[Zenetusken]

What this PR does

Hardens the _browser plugin's agentic-browsing harness against six failure modes observed in live agent sessions (evidence from saved chat logs of a real browsing task). Developed by the agent itself while debugging its own tooling, then reviewed, corrected and validated before submission.

Fixes

1. Reference labels accepted as refs (browser-page-content.js): normalizeReferenceId now parses rendered reference descriptors like [input text 1] and link 3 back to their numeric id — previously the model copying the label it saw on screen produced an unresolvable ref.
2. set_checked works on helper-backed references (browser-page-content.js, browser-dom-helper.js): helper-backed refs previously threw browser_page_content_checked_helper_backed; they now route through the DOM helper via a new set_checked_node operation (setCheckedLocalNode / setCheckedNode), supporting native checkbox/radio inputs, ARIA checkbox/radio/switch/menuitemcheckbox/menuitemradio roles, and aria-pressed toggle buttons, with proper input/change event dispatch.
3. Navigation races no longer error out the action (runtime.py): _reference_action catches Playwright's navigation-context errors (Execution context was destroyed, most likely because of a navigation) and returns a {"navigation": True} action result with fresh page state, instead of failing the tool call. Matching is restricted to Playwright's specific phrases so genuine script errors mentioning "navigation" still raise (regression-tested).
4. Error pages are surfaced, not hidden (runtime.py): _state detects chrome-error://, edge-error:// and chromewebdata URLs and reports error_page/error: "browser_error_page" fields plus original_title, so automation can distinguish DNS/load failures from a loaded page.
5. evaluate accepts expression as an alias for script (browser.py): the documented/natural argument name now works — previously action=evaluate with expression silently evaluated an empty script and returned null.

Review corrections applied before opening

• Removed an overly broad bare "navigation" substring from the navigation-error matcher (would have swallowed genuine errors like "navigation is not allowed here"); added a regression test proving such errors re-raise.
• Fixed the expression-alias test's incorrect call-args assertion ((1,) → (1, "1+2")) — the test failed as originally written.

Verification

• tests/test_browser_agent_regressions.py: 109 passed, 1 skipped in the agent0ai/agent-zero:v2.6 image with agent_zero_usr mounted read-only — including new behavioral tests for the navigation race (fake page raising Playwright's error), chrome-error state reporting, the expression alias end-to-end through Browser.execute, and source markers for the JS helpers.
• Full suite (--continue-on-collection-errors): failure set byte-identical to pristine 5ff106a2 (93 pre-existing failures/errors from the sys.modules stub poisoning that test(suite): guard live /a0/usr writes and fix cross-module test pollution #1799 fixes; zero new failures). JS assets pass node --check; Python files compile.
• Fixes 3-5 sit behind additive keys/parameters; existing state consumers and tool callers are unaffected (no existing assertions needed changes).

[Zenetusken]

Added commit c8670019: raw-string prefixes on the two regex-marker assertions in test_reference_normalization_accepts_descriptive_labels (silences Python invalid-escape warnings; strings are byte-identical, verified). This folds in the cosmetic edit observed on the live deployment so the PR head matches production.