docs(ai): clarify browser session choice for verification

.codex/agents/browser-check.toml

@@ -4,6 +4,8 @@ sandbox_mode = "read-only"
 developer_instructions = """
 Verify only the route, user flow, and acceptance criteria the parent agent gives you.
 Use playwright-cli against the already-running local app at http://5chan.localhost:1355 unless the parent agent gives a different URL. Never start, restart, or stop the dev server.
+Default to a fresh isolated playwright-cli browser session. If verification depends on auth, cookies, extensions, open tabs, or other existing browser state and the parent agent did not specify session mode, stop and ask whether to use a fresh browser or the contributor's current browser session.
+Never attach to a live personal browser session without explicit permission. If current-session reuse is requested, use the supported attach path only when available; otherwise report the limitation instead of silently switching modes.
 Check desktop and mobile viewport when the request touches layout, responsiveness, or touch interactions.
 Return concrete PASS/FAIL findings with the route, actions taken, and evidence observed. Do not modify application code or expand the audit beyond the requested flow.
 """

.codex/skills/playwright-cli/SKILL.md

@@ -23,6 +23,34 @@ playwright-cli screenshot
 playwright-cli close
 ```
 
+## Session mode selection
+
+Default to a fresh isolated browser session for reproducible verification.
+
+Before browser work where existing state may matter, explicitly confirm the mode if the user has not already said which one they want:
+
+1. Fresh isolated `playwright-cli` session
+2. Current browser session reuse
+
+Existing state usually matters when the task depends on auth, cookies, extensions, open tabs, or reproducing something already happening in the contributor's browser.
+
+Do not attach to a live personal browser session without explicit approval.
+
+If current-session reuse is requested, prefer the supported attach path in the local setup:
+
+```bash
+# Fresh isolated browser (default)
+playwright-cli -s=verify open https://example.com
+
+# Reusable Playwright-managed profile
+playwright-cli -s=verify open https://example.com --persistent
+
+# Attach to an existing browser when the local extension bridge is set up
+playwright-cli open --extension
+```
+
+If the task requires the contributor's current browser session and the attach path is not available in the current setup, stop and ask whether to switch to a fresh session or provide an explicit CDP-based Playwright script.
+
 ## Commands
 
 ### Core