back/forward report "Inspected target navigated or closed" after the navigation succeeded

agent-browser back (and, by the same code, forward) can return an error even though the navigation succeeded:

$ agent-browser --json back
{"success":false,"error":"CDP error (Runtime.evaluate): Inspected target navigated or closed"}
$ agent-browser get url
http://localhost:8931/          # the previous page — the back navigation happened

It is intermittent. On macOS with Chrome for Testing it failed 3 of 3 times against pages served by python3 -m http.server, and only sometimes against a small Node http server.

Reproduce

mkdir /tmp/ab-back && cd /tmp/ab-back
echo '<a href="two.html">two</a>' > index.html
echo '<p>two</p>' > two.html
python3 -m http.server 8931 &

agent-browser open http://localhost:8931/
agent-browser open http://localhost:8931/two.html
agent-browser --json back      # often: success:false, "Inspected target navigated or closed"
agent-browser get url          # http://localhost:8931/

Seen on agent-browser 0.39.1; the code path is unchanged on main (dac13bb).

Cause

handle_back in cli/src/native/actions.rs (~L6826 on main) runs

mgr.evaluate("history.back()", None).await?;
tokio::time::sleep(Duration::from_millis(500)).await;
let url = mgr.get_url().await.unwrap_or_default();

and waits for the Runtime.evaluate reply. The navigation history.back() starts tears down the execution context, so the reply can arrive as "Inspected target navigated or closed". The ? propagates it, and the sleep/get_url that would report the new page never run. handle_forward (~L6845) is identical. The race is plausibly lost more often when the previous page is restored from the back/forward cache, but that is a guess.

Suggested fix

Either of:

• Navigate through CDP history instead of page script: Page.getNavigationHistory, then Page.navigateToHistoryEntry with the previous/next entry id. That does not depend on the page's execution context surviving.
• Or treat "Inspected target navigated or closed" from this specific evaluate as success and continue to the existing wait and get_url.

Environment

• agent-browser 0.39.1 (native CLI), Chrome for Testing, macOS
• Pages served by python3 -m http.server (fails consistently) and a Node http server (fails sometimes)