fix(kernel): send profile as object so KERNEL_PROFILE_NAME works

[boatri]

Fixes #1473

Summary

• connect_kernel() sent the create-browser profile field as a bare string; Kernel's API expects an object ({ name, save_changes }), so every open with KERNEL_PROFILE_NAME set failed with a 400 at JSON-decode time.
• Send { name, save_changes: true } instead. save_changes defaults to true so cookies/logins persist across sessions, matching the documented profile behavior (the SDK default is false, which would load the profile but silently never persist).
• Extract a small kernel_profile_from_env() helper and add unit tests for the object shape and the unset/empty cases.

Why

With KERNEL_PROFILE_NAME set, agent-browser open always failed:

✗ Kernel API error (400): can't decode JSON body: json: cannot unmarshal
  string into Go struct field BrowserRequest.profile of type map[string]json.RawMessage

The API expects the @onkernel/sdk BrowserProfile shape ({ id?, name?, save_changes? }), not a string. Posting to POST /browsers directly with the same pre-existing profile, varying only the profile field:

profile value	Status
"my-profile" (string, old behavior)	400 cannot unmarshal string into ... profile
{ "name": "my-profile", "save_changes": true } (this PR)	200, browser created

So the string is rejected at decode time regardless of whether the profile exists — purely a serialization mismatch.

Test plan

• cargo fmt --manifest-path cli/Cargo.toml -- --check
• cargo clippy --manifest-path cli/Cargo.toml -- -D warnings (clean)
• cargo test --manifest-path cli/Cargo.toml — new unit tests pass:
  • test_kernel_profile_from_env_is_object_not_string
  • test_kernel_profile_from_env_unset_or_empty
• End-to-end against a real Kernel account with a pre-created profile:
  • KERNEL_PROFILE_NAME=<profile> agent-browser open … now returns 200 (was 400)
  • Wrote localStorage in session A, closed, reopened the same profile in session B → value persisted (confirms save_changes: true)

[vercel]

@boatri is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.