fix(govern): observe({page}) routes through the live-capture path

[askalf]

What

captureFromBridge has accepted a caller-owned {page} since the broker seam (PR #5) — but observe()'s hasBridge check only looked for browserWSEndpoint/browserURL, so a bare observe({page}) silently fell through to captureFromHtml(undefined) instead of reading the live session.

One-line routing fix: input.page != null now counts as a bridge target. captureFromBridge already handles the rest — page reused as-is, no navigation when no url/html is given (current page state read in place), lifecycle untouched, url from page.url().

Why now

Dogfooding: askalf's fleet browser_use tool (platform#701) firewalls its live Puppeteer session through fieldpass. Today it has to serialize the DOM and use the static path; with this seam it can hand its page straight to observe() and get live-extractor parity — computed-style hidden detection and shadow-root descent on the agent's current page state.

Tests

New regression in test/broker.test.mjs: observe({page}) must produce capturedBy: 'cdp', read page.url(), perform zero navigations, and surface the live node text in the safe view. Suite: 146/146 green locally (fresh npm install).

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: No blocking issues found — clean, well-scoped one-line routing fix with a matching regression test.

What I checked

• gh pr diff for the full change (2 files, +27/-3): src/govern.mjs and test/broker.test.mjs.
• src/capture.mjs::captureFromBridge (not touched by this PR) to confirm the opts.page branch it already implements matches what the PR's comments claim: src/capture.mjs:261-269 — when opts.page is set, it only calls page.setContent/page.goto if html/url are given, otherwise reads the page as-is and pulls url from page.url(). That matches the PR description's claim of "no navigation when no url/html is given."
• CI rollup via gh pr checks 56: CodeQL, analyze, test, test-node20 — all pass.

The fix

src/govern.mjs:98 (new):

const hasBridge = input.browserWSEndpoint != null || input.browserURL != null || input.page != null;

Before this PR, observe({page}) alone (no browserWSEndpoint/browserURL) fell through to captureFromHtml(input.html, ...) with input.html === undefined, silently bypassing the live-capture path that captureFromBridge already supported for a caller-owned page. Adding input.page != null to the bridge-detection predicate is the correct, minimal fix — captureFromBridge (untouched) already handles the opts.page case correctly, so this is purely a routing correction at the call site.

Test coverage

test/broker.test.mjs adds a regression test (observe({page}) ...) that stubs a page with goto/evaluate/url(), asserts capturedBy: 'cdp', the live URL is read, zero navigations occur, and the live text surfaces in safe.text — directly covering the bug this PR fixes.

What's good

• The fix is a single-condition addition with no behavioral change to the existing browserWSEndpoint/browserURL paths.
• Comments explain why (not just what), and correctly describe captureFromBridge's existing no-navigation-on-bare-page behavior.
• New test isolates the exact regression scenario described in the PR body.
• All CI checks green (CodeQL, analyze, test, test-node20).

No correctness, security, reuse, or efficiency concerns in the changed lines.