Give tracker agents a browser to read setters

The tracker-mapping and common-pattern enrichment agents only had
web search, which returns title/url/snippet, so they could never
open a cookie-database or cookie-policy page to read which vendor
actually sets a tracker. This mis-attributed setters whose snippet
is misleading (e.g. _li_* read as LinkedIn rather than LiveIntent).

Wire the read-only headless-browser toolset into both agents, gated
on a configured Chrome endpoint, mirroring the common-third-party
enrichment worker: agent construction moves into the run path so each
run can carry a per-run browser that is closed when the run returns.
The prompts now direct the agent to open a promising result and read
the named setter from the full page text. Both agents stay unchanged
when no Chrome endpoint is configured.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/tracker_mapping_agent.go

@@ -75,16 +75,24 @@ type TrackerMappingAgentResult struct {
 	ThirdPartyConfidence float64                     `json:"third_party_confidence" jsonschema:"Confidence (0.0 to 1.0) in which company or service set this tracker, independent of whether the artifact is a classic web tracker. Set below 0.5 if unsure who set it."`
 }
 
+// buildTrackerMappingAgent builds the tracker-mapping agent. extraTools
+// carries the browser read-only toolset when a headless Chrome endpoint
+// is configured; it is empty otherwise, in which case the agent relies on
+// the DB search tools and web search alone. The browser lets it open
+// cookie-database and cookie-policy pages to read the true setter.
 func buildTrackerMappingAgent(
 	cfg TrackerMappingAgentConfig,
 	pgClient *pg.Client,
 	logger *log.Logger,
+	extraTools []agent.Tool,
 ) *agent.Agent {
 	tools := []agent.Tool{
 		searchTrackerPatternsTool(pgClient),
 		searchThirdPartiesTool(pgClient),
 	}
 
+	tools = append(tools, extraTools...)
+
 	if cfg.FirecrawlAPIKey != "" {
 		tools = append(tools, search.FirecrawlSearchTool(cfg.FirecrawlAPIKey))
 	}