docs(browser): document six browser tools and enablement gates

config/default.yaml

@@ -193,6 +193,20 @@ models:
 #   default_namespace: default
 #   allowed_namespaces: []  # Empty = allow any namespace; set to restrict access.
 
+# Optional: Browser automation tools (browser.navigate/screenshot/click/type/content/eval)
+# Requires a local Chrome/Chromium install or a remote CDP endpoint.
+# browser:
+#   enabled: true
+#   # executable_path: /usr/bin/google-chrome
+#   # ws_endpoint: ws://127.0.0.1:9222/devtools/browser/<id>
+#   headless: true
+#   max_pages: 5
+#   default_timeout: 30000
+#
+# Tool policy reminder:
+# - `tools.profile: coding` or `tools.profile: full` must allow browser.* tools.
+# - `tools.deny` patterns can still block browser.* even when browser.enabled is true.
+
 hooks:
   confirm:
     - shell.*