fix: update browser-use fork to prevent download OOM

[254808127]

Summary

Update the browser-use dependency from b174da3fcd1c6483fbae9746cbc686fb97b502a5 to 540eef7c85d1165b54554e1faf174faf4189dd93 to pick up the reviewed download OOM fix from 254808127/browser-use#1.

The new pin merges the fork's reviewed main (ed8eef39a9a14e79fb1f20706a2dd563b97276bd) into the existing integration branch. This preserves the session/OOPIF fixes already present in the old pin; pointing directly at fork main would drop those fixes. Git ancestry and equality of the download implementation/tests against merged fork main were verified.

Both automatic download paths now read browser Blobs in bounded 256 KiB CDP chunks, without serializing a whole-file JavaScript number array. The reviewed version also finishes cancellation-safe resource cleanup before publishing the destination file.

This PR changes one dependency line. The locally updated uv.lock remains ignored under the repository's existing policy.

Contribution type

• Bug fix

Reproduction or validation

• uv sync --extra dev --extra browser-use
• uv run pytest tests/: 840 passed, 2 skipped, 59.48 seconds.
• uv lock --check and git diff --check: passed.
• Integrated browser-use revision: 26 download tests passed, including real Chromium CDP and repeated-cancellation tests.

Real smoke command (runtime YAML supplies existing environment-variable credentials):

bubench run --agent browser-use --data LexBench-Browser --mode single \
  --model gpt-5.4 --browser lexmount --agent-config <runtime-config.yaml> --timeout 900

The Agent ran against a real remote browser; task 5 completed in 124.4 seconds:

Starting a browser-use agent with version 0.13.4, with provider=openai and model=gpt-5.4
[SUCCESS] Task completed successfully
[TIMING] Task wall-clock time: 124.4s
[SUMMARY] Total: 1 | Success: 1 | Failed: 0

The original S2 Online-Mind2Web task also completed using the same pinned revision and real Lexmount backend:

bubench run --agent browser-use --data Online-Mind2Web --mode by_id \
  --id 48c73f3f53e2611c4a1052457c1033db --model gpt-5.4 \
  --browser lexmount --agent-config <runtime-config.yaml> --timeout 900

• Task completed in 254.4 seconds, after reading the 371-page MTA FEIS PDF.
• Downloaded from https://www.mta.info/document/10341: 24,865,690 bytes.
• SHA-256: 2a036ad51d4c04ba6784a1f9f280c2637f1d9794af154513b920f1bf60b5b07e, matching the original reproduction PDF.
• The Agent initially selected the browser container's native download path, which is not accessible on the runner, then successfully read the streamed runner-local copy. The native download path warning and click timeout remain separate existing behaviors.

Self-review (mandatory)

• I read every line of my diff and every change is intentional.
• The diff passes the hard rules in CONTRIBUTING.md.
• I ran a local /code-review and fixed or justified every finding.
• uv run pytest tests/ passes; targeted behavior coverage is in the pinned fork.
• Agent-touching change: real smoke run evidence is included above.
• No secrets, cookies, or unredacted logs in the diff.

Notes for reviewers

Draft because the required local Claude review is unavailable. Attempted the prescribed claude -p "/code-review ..." and explicit-model retries. Each returned an unavailable-model error (claude-opus-4.8 / claude-opus-4-8[1m]) before producing a review. The checkbox is intentionally left unticked; manual diff review, tests, and real smoke execution are complete. The required local automated review remains to be run when the configured service is available.

Initial validation setup failures were resolved by installing the agent extra and exporting uv on PATH. The clean base also lowercases runtime configuration keys while its CDP backend only reads CDP_ADDRESS, causing external-CDP setup to fall back to localhost:9222. The successful smoke uses the existing Lexmount backend; this PR does not include that separate CDP configuration fix or pre-existing local provider edits.