Rewrite chromium-headful + chromium-headless wrapper as a Go binary

Replaces the bash wrapper.sh shipped in both browser images with a single
Go binary (server/cmd/wrapper) that detects the headful vs headless
profile from supervisor's conf.d at boot.

The Go wrapper preserves behaviour parity with the bash scripts but
removes serial dead time on the boot path:

  - Phase A starts xorg/xvfb, dbus, and chromedriver in a single
    supervisorctl invocation; readiness is then probed concurrently.
  - Envoy bootstrap (cert generation, NSS DB, template render) runs
    in a goroutine alongside Phase A. Phase B gates on it because
    chromium reads the system CA trust store at process start.
  - Phase B starts chromium, kernel-images-api, and (headful) mutter
    + optional neko in one call so their bring-up overlaps chromium boot.
  - Final readiness waits on the union of CDP, chromedriver,
    forward-proxy, and (when enabled) neko + envoy in parallel.

Per-service tweaks:

  - supervisor confs: startsecs=2 → 0 so supervisorctl start returns
    as soon as the program is launched (Go probes readiness directly).
  - init-envoy.sh: drop the trailing 50-iteration port poll and
    curl-through-proxy test; the Go wrapper's waitAllReady covers it.
  - Kraftfile cmd updated from /wrapper.sh to /wrapper.

Cosmetic + non-critical work (pulseaudio, --no-sandbox infobar
dismissal) runs off the hot path.

Author: sjmiller609

README.md

@@ -83,7 +83,7 @@ Deployed successfully!
  ├────── service: <service_name>
  ├─ private fqdn: <id>
  ├─── private ip: <ip>
- └───────── args: /wrapper.sh
+ └───────── args: /wrapper
 ```
 
 ### Unikernel Notes

images/chromium-headful/Dockerfile

@@ -27,6 +27,12 @@ RUN --mount=type=cache,target=/root/.cache/go-build,id=$CACHEIDPREFIX-go-build \
     GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
     go build -ldflags="-s -w" -o /out/chromium-launcher ./cmd/chromium-launcher
 
+# Build container entrypoint wrapper (replaces wrapper.sh)
+RUN --mount=type=cache,target=/root/.cache/go-build,id=$CACHEIDPREFIX-go-build \
+    --mount=type=cache,target=/go/pkg/mod,id=$CACHEIDPREFIX-go-pkg-mod \
+    GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
+    go build -ldflags="-s -w" -o /out/wrapper ./cmd/wrapper
+
 # webrtc client
 FROM node:22-bullseye-slim AS client
 WORKDIR /src
@@ -348,7 +354,6 @@ COPY --from=xorg-deps /usr/local/lib/xorg/modules/input/neko_drv.so /usr/lib/xor
 COPY images/chromium-headful/image-chromium/ /
 COPY images/chromium-headful/start-pulseaudio.sh /images/chromium-headful/start-pulseaudio.sh
 RUN chmod +x /images/chromium-headful/start-pulseaudio.sh
-COPY images/chromium-headful/wrapper.sh /wrapper.sh
 COPY images/chromium-headful/supervisord.conf /etc/supervisor/supervisord.conf
 COPY images/chromium-headful/supervisor/services/ /etc/supervisor/conf.d/services/
 COPY shared/envoy/supervisor-envoy.conf /etc/supervisor/conf.d/services/envoy.conf
@@ -365,6 +370,7 @@ RUN chmod +x /usr/local/bin/init-envoy.sh
 # copy the kernel-images API binary built in the builder stage
 COPY --from=server-builder /out/kernel-images-api /usr/local/bin/kernel-images-api
 COPY --from=server-builder /out/chromium-launcher /usr/local/bin/chromium-launcher
+COPY --from=server-builder /out/wrapper /wrapper
 
 # Copy and compile the Playwright daemon
 COPY server/runtime/playwright-daemon.ts /tmp/playwright-daemon.ts
@@ -381,4 +387,4 @@ RUN esbuild /tmp/playwright-daemon.ts \
 
 RUN useradd -m -s /bin/bash kernel
 
-ENTRYPOINT [ "/wrapper.sh" ]
+ENTRYPOINT [ "/wrapper" ]

images/chromium-headful/Kraftfile

@@ -9,4 +9,4 @@ labels:
 
 rootfs: ./initrd
 
-cmd: ["/wrapper.sh"]
+cmd: ["/wrapper"]

images/chromium-headful/supervisor/services/chromedriver.conf

@@ -2,6 +2,6 @@
 command=/usr/local/bin/chromedriver --port=9225 --allowed-ips=127.0.0.1 --log-level=INFO
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/chromedriver
 redirect_stderr=true

images/chromium-headful/supervisor/services/dbus.conf

@@ -2,6 +2,6 @@
 command=/bin/bash -lc 'mkdir -p /run/dbus && dbus-uuidgen --ensure && dbus-daemon --system --address=unix:path=/run/dbus/system_bus_socket --nopidfile --nosyslog --nofork'
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/dbus
 redirect_stderr=true

images/chromium-headful/supervisor/services/kernel-images-api.conf

@@ -2,6 +2,6 @@
 command=/bin/bash -lc 'mkdir -p "${KERNEL_IMAGES_API_OUTPUT_DIR:-/recordings}" && PORT="${KERNEL_IMAGES_API_PORT:-10001}" FRAME_RATE="${KERNEL_IMAGES_API_FRAME_RATE:-10}" DISPLAY_NUM="${KERNEL_IMAGES_API_DISPLAY_NUM:-${DISPLAY_NUM:-1}}" MAX_SIZE_MB="${KERNEL_IMAGES_API_MAX_SIZE_MB:-500}" OUTPUT_DIR="${KERNEL_IMAGES_API_OUTPUT_DIR:-/recordings}" LOG_CDP_MESSAGES="${LOG_CDP_MESSAGES:-false}" exec /usr/local/bin/kernel-images-api'
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/kernel-images-api
 redirect_stderr=true

images/chromium-headful/supervisor/services/mutter.conf

@@ -2,6 +2,6 @@
 command=/bin/bash -lc 'XDG_SESSION_TYPE=x11 mutter --replace --sm-disable'
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/mutter
 redirect_stderr=true

images/chromium-headful/supervisor/services/neko.conf

@@ -2,6 +2,6 @@
 command=/usr/bin/neko serve --server.static /var/www --server.bind 0.0.0.0:8080
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/neko
 redirect_stderr=true

images/chromium-headful/supervisor/services/xorg.conf

@@ -2,6 +2,6 @@
 command=/usr/bin/Xorg :1 -config /etc/neko/xorg.conf -noreset -nolisten tcp
 autostart=false
 autorestart=true
-startsecs=2
+startsecs=0
 stdout_logfile=/var/log/supervisord/xorg
 redirect_stderr=true