fix: prevent desktop app from opening OS's browser for local pages

[afsuyadi]

What

1. Enforce prompt for AGENTS.md to make sure it doesn't open OS's browser when encountering URLs.
2. Add a safety check for checking either if the session is orchestrator session or worker session

Why

Fixes #2809 .

To ensure that the local pages stay in Desktop app's preview pane, not opened in the OS's browser.

How

Key implementation decisions, trade-offs, or areas reviewers should focus on.
Call out intentional omissions (especially vs older TypeScript behavior) when relevant.

Testing

I add a test file to test out the changes. Here are the CLI to run these two functions (matched by Regex):

• TestSessionsAPI_SetPreviewRejectsOrchestratorSession
• TestSessionsAPI_ClearPreviewRejectsOrchestratorSession

cd backend
go test ./internal/httpd/controllers/sessions_test.go -run 'RejectsOrchestratorSession' -v

Result after testing (via Terminal):

$ AO_SESSION_ID=verify-proj-1 ao preview http://localhost:3002/landing   # orchestrator
Orchestrator sessions have no browser preview panel; run ao preview from a worker session (PREVIEW_UNSUPPORTED_SESSION_KIND) [request ...]
exit code: 1

$ AO_SESSION_ID=verify-proj-2 ao preview http://localhost:3002/landing   # worker
exit code: 0

Result after testing (via Desktop App):

Checklist

• Branched from main (or continuing an existing PR branch)
• One focused change; links the related issue when applicable
• Follows AGENTS.md conventions and PR hygiene
• Tests added/updated for user-visible behavior where it makes sense
• Relevant CI checks pass for the area touched (go, frontend, etc.)

[afsuyadi]

@AgentWrapper Please inform me if there is something missing or not right. Thanks!

[somewherelostt]

Thanks for contributing to Agent Orchestrator.

This PR is being picked up by the current external contributor on-call pair:

• @neversettle17-101
• @somewherelostt

If someone is already working on this, please continue as usual.
The on-call pair is added for visibility, tracking, and support, not to take over the work.
If you need help with review, direction, reproduction, or next steps, please tag @neversettle17-101 and @somewherelostt here.

For faster context or live questions, you can also join the AO Discord.

Join the session here:
https://discord.gg/H6ZDcUXmq

Come by if you want to see what is being built, ask questions, or just hang around with the community.

[afsuyadi]

I see, thanks for the info. I'll be joining the discord @somewherelostt

[afsuyadi]

Please inform me if there is anything missing or need to be added @neversettle17-101 @somewherelostt