Bake CloakBrowser instead of vanilla Chromium in the cloud slice pre-bake

[minhtrinh-imbue]

Summary

• Cloud slices' box-image pre-bake (SliceVpsDockerProvider._build_cloakbrowser_derived_image, née _build_playwright_derived_image) now bakes CloakBrowser instead of vanilla Playwright-managed Chromium, matching the engine swap landing in default-workspace-template (see companion PR there).
• Keeps playwright install-deps chromium for the apt shared-libs only (no browser download), then curl+SHA256-verifies+unpacks a pinned CloakBrowser release (chromium-v146.0.7680.177.4, x64 -- cloud slices are x86_64 bare metal only) to /opt/cloakbrowser/.
• Splits the single done.playwright marker into done.playwright_deps + done.cloakbrowser, matching default-workspace-template's deferred_install.sh split, so a loaded slice's deferred-install service still no-ops on both steps. pool_bake.py's wait_for_deferred_install now waits on the final done.cloakbrowser marker.

Test plan

• slice_provider_test.py::test_build_cloakbrowser_derived_image_renders_marker_and_build_command -- passes, includes a bash -n syntax check on the generated Dockerfile RUN line
• pool_bake_test.py::test_wait_for_deferred_install_polls_for_marker_or_finished_process -- passes
• Verified in an isolated worktree off latest main (not just the dev branch these edits were drafted against)
• Not run: an actual slice bake against a real box (needs cloud infra access)

🤖 Generated with Claude Code

[minhtrinh-imbue]

For the CloakBrowser constants here (`_CLOAKBROWSER_VERSION`, `_CLOAKBROWSER_SHA256_X64`, `_CLOAKBROWSER_INSTALL_DIR`, `_CLOAKBROWSER_RELEASE_URL`) -- full context on where CloakBrowser came from, why it replaced Fortress/vanilla Chromium, the exact variable-by-variable breakdown (including the Playwright-vs-browser-use executable_path distinction), and step-by-step instructions for bumping the version or swapping engines later, lives in the companion PR:

libs/browser/CHROMIUM_ENGINE_DESCRIPTION_AND_FUTURE_GUIDELINES.md -- imbue-ai/default-workspace-template#290

These constants are a manually-kept-in-sync mirror of the ones in that repo's `scripts/deferred_install.sh` (row 7 in the doc's table) -- if you bump the version here, bump it there too, and vice versa.

🤖 Generated with Claude Code

[minhtrinh-imbue]

Superseded — same reason as imbue-ai/default-workspace-template#290: switching to Fortress now that a native arm64 build exists (tiliondev/fortress#28). Cloud pre-bake changes will follow in a separate PR once the desktop-side deferred_install.sh swap lands.