fix(provider): do not launch a provider for close

Summary

• Do not send an implicit provider launch before a parsed close command.
• Preserve normal daemon close dispatch and provider cleanup ownership. A cold close can still start an empty native daemon; it must not allocate a provider browser first.
• Keep the MCP close tool aligned through its normal CLI delegation, and clarify this provider-close behavior in help, skill/reference material and docs.

This applies to explicit --provider selection and AGENT_BROWSER_PROVIDER. The guard uses the parsed action, not a scan of user argument strings. Other launch paths, explicit launches and batch behavior are unchanged.

Reproduction and tests

The added integration fixture is entirely local. Its provider writes a marker and rejects launch, so the regression does not need Chrome, provider credentials or a live account.

On unmodified main, four CLI cases (explicit/environment provider, cold/existing browserless daemon) and the MCP close tool invoke that hook and fail instead of closing. The positive control confirms ordinary browser commands still invoke the selected provider. The fixture isolates HOME/XDG/config/socket state and clears inherited native options.

• RED on main 372ac5ce20fab885dbf45ee0c9d510ec8c3b6fdb: five close cases fail; the normal provider-launch control passes.
• GREEN with this change: all six cases pass, using identical fixture source and the same compiled integration harness.
• All non-ignored native/CLI artifacts pass on private loopback: 1,482 native unit tests and 29 CLI integration tests. The 157 ignored native tests and two ignored real-Chrome pinning tests are not claimed as verified.
• cargo fmt -- --check and git diff --check pass.
• cargo clippy --tests completes with three warnings in untouched files: doctor/helpers.rs, native/cdp/chrome.rs, and native/cdp/client.rs.
• Required docs gates pass: pnpm --filter docs test (54 tests), type-check, build, and test:routes (439 tests).
• Before/after checks confirm the installed Agent Browser binary/configuration/current link and broker PID were unchanged.

Existing-daemon cases use a browserless native daemon. These tests do not claim real cloud-provider teardown qualification; backend close/cleanup code is unchanged.

No version bump or production installation is included.