fix: bare `open` no longer relaunches without configured profile

Problem

agent-browser open (bare, no URL) with --profile/AGENT_BROWSER_PROFILE configured launches the profile browser and then immediately relaunches without the profile into a throwaway --user-data-dir=/tmp/agent-browser-chrome-<uuid> — losing all login state. Tracked in #1977.

Repro (AGENT_BROWSER_PROFILE=~/x --headed):

$ agent-browser open
[agent-browser] relaunched browser
✓ Done

ps during the run shows two Chrome spawns ~0.5 s apart: first with --user-data-dir=<profile>, then with --user-data-dir=/tmp/agent-browser-chrome-<uuid>. Every bare open relaunches, even against a healthy browser.

Root cause

open with no URL parses to {"action":"launch","headless":...} (commands.rs) — a bare launch envelope carrying none of the launch options. With launch config flags set (profile, executable path, etc.), the CLI sends two envelopes in one invocation:

1. The config launch envelope (has profile, executablePath, …) → daemon launches the browser on the profile.
2. The bare open envelope (no options) → daemon's handle_launch_inner builds launch options from only the command fields, computes a different launch_hash, sees hash_changed against the healthy browser, closes it, and relaunches profile-less.

Fix

Two small changes:

1. CLI (main.rs): when this invocation already sent a config launch envelope, skip the redundant bare launch envelope — the config envelope already launched the browser on about:blank, which is exactly what bare open wants. Encapsulated in bare_launch_follows_config_launch() with a unit test.
2. Daemon (actions.rs): fall back to AGENT_BROWSER_PROFILE when the launch envelope has no profile field, mirroring the existing executablePath env fallback. This covers other stripped-envelope senders (plugins, MCP) the same way.

Testing

• New unit test bare_open_after_config_launch_is_suppressed (envelope suppression for: bare open with config, open <url> navigate path, bare open without config).
• Manual verification with --headed + profile (instrumented launcher argv capture):
  • bare open → single launch, --user-data-dir=<profile> ✓ (was: profile launch + temp-dir relaunch)
  • repeat bare open → no relaunch, browser reused ✓
  • open <url> → unaffected, navigates on the profile browser ✓
  • no env/flags at all → headless temp-dir fallback still works ✓
  • --json mode output preserved ✓

Fixes #1977