feat: reuse a signed-in Chrome profile for browser web search

Add CHROME_USER_DATA_DIR so the browser search fallback can open Chrome
against a dedicated, Google-signed-in profile instead of a fresh anonymous
session. A returning signed-in profile is what actually avoids Google's
/sorry bot-detection page, so this is the reliable way to get browser
Google search in plain text turns. Fallback order is now CDP (broadcast
Chrome) -> persistent profile (when configured) -> ephemeral headless,
all still fail-open to the DDG/Brave/Wikipedia cascade.

Document the profile in .env.example and web_search.spec.md.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -98,6 +98,15 @@ CHROME_START_URL=about:blank
 #           on-screen browser for real-time info (search / play / read screen).
 #   false = no screen share; voice only, real-time info via the Gemini API.
 STREAM_BROWSER=true
+# Optional: profile dir for browser-based Google search in plain text turns
+# (no active broadcast). When set, the search helper opens Chrome against this
+# profile instead of a fresh anonymous one. Sign that profile into Google once
+# (run a real Chrome with --user-data-dir=<this path> and log in) so Google
+# treats later searches as a returning user and does not serve the bot-detection
+# page. Leave blank to use an ephemeral headless session (works only where
+# Google does not challenge it). Use a DEDICATED dir, not your everyday Chrome
+# profile, to avoid the "profile in use" lock while Chrome is open.
+CHROME_USER_DATA_DIR=
 # Gemini auth for real-time info when STREAM_BROWSER=false.
 #   oauth  = use the Gemini CLI with a Google-account login (no API key).
 #            Install once: npm i -g @google/gemini-cli ; then run `gemini` and