This signed browser-helper only opens the PRIVATE/PIXEL browser/WebUSB flow and performs bounded host checks. It cannot start native-first AOA, ADB actions, Fastboot unlock/relock, or flash.
