chore: install web access empowerment stack

[Hades898]

Summary

• Installs the web-access empowerment stack for the Hermes swarm: agent-browser + local Crawl4AI.
• Wires Researcher, QA, Builder, and Maintainer in swarm.yaml, agent READMEs, workspace skills, docs, and package scripts.
• Adds safe eval runners, a validator, a setup script, docker-compose Crawl4AI service, and governance docs.
• Keeps cloud/proxy/CAPTCHA/credential/public-action/destructive paths gated and non-default.

Verification

• python3 scripts/validate-web-access-empowerment.py
• bash evals/web-access/run-web-access-suite.sh
• git diff --cached --check
• Clean-checkout staged patch simulation: validator + shell syntax PASS
• Independent reviewer first pass: BLOCK, then blockers fixed
• Independent reviewer second pass: PASS

Guardrails

• Safe suite only runs example.com + localhost Crawl4AI status/health.
• Gated anti-bot, auth persistence, token/cost baseline, cloud, proxy, CAPTCHA, public-action, and destructive lanes are defined as manual-gated only.
• No new MCP server added.
• Crawl4AI is loopback-bound at 127.0.0.1:11235.

Notes

• Active laptop runtime verified: agent-browser 0.27.0, unclecode/crawl4ai:0.8.5 healthy.
• Parent fan-in noted a worker-executor permission caveat: tmux/Codex child workers may lack Docker/agent-browser daemon permissions, so parent verification is required until worker runtime inheritance is fixed.