Debug-only, loopback WebDriver transport for Blitz renderers.

The server owns networking and session authentication. Renderer commands cross a serialized channel and must be executed by the UI/runtime thread.

Security boundary

Enabling this server grants the holder of its per-process discovery token debugger-level control, including arbitrary JavaScript execution in the document. It deliberately has the same trust posture as a browser remote debugging port: loopback-only transport, an unpredictable token, and a descriptor created with owner-only permissions on Unix. It is not a sandbox or an authorization boundary against another process running as the same OS user and able to read that user's files. Production builds should leave the feature and its environment variables disabled.