feat: cloak profile - CloakBrowser stealth Chromium image

[lroolle]

Description

Add a cloak image profile: rust image + CloakBrowser stealth Chromium, headed on Xvfb. deva.sh -p cloak <agent> gives agents a real anti-detection browser inside the sandbox.

Type

• New feature

Details

• Dockerfile.cloak extends :rust; bakes the cloakbrowser npm wrapper + Chromium binary at build time (hermetic, auto-update off). Wrapper pin CLOAKBROWSER_WRAPPER_VERSION also pins Chromium.
• cloak-entrypoint.sh: Xvfb :99 + openbox, then chains to docker-entrypoint.sh; tini stays PID 1.
• deva.sh: -p cloak profile, tag fallback cloak > rust > latest.
• skills/deva-cloak: agent-facing usage skill (DEVA_CLOAK=1 marker).
• Release pushes :cloak and :vX.Y.Z-cloak; paths-filtered CI workflow builds and tests the image. Nightly skips cloak on purpose (no agent CLIs in that layer).

Related Files

Dockerfile.cloak, scripts/cloak-entrypoint.sh, skills/deva-cloak/, deva.sh, Makefile, versions.env, scripts/version-pins.sh, scripts/update-version-pins.sh, .github/workflows/{release,cloak-image}.yml, docs/advanced-usage.md

Test Plan

• make build-cloak && make test-cloak (cloakbrowser info --quick, xdotool getdisplaygeometry)
• deva.sh -p cloak claude --dry-run resolves image/tag correctly
• make versions-pin round-trips CLOAKBROWSER_WRAPPER_VERSION in versions.env
• release workflow pushes :cloak tag