Persist mac-7 tailnet CDP proxy endpoint

shared/long-term/decisions/browser-endpoints-mac5-mac7.md

@@ -44,27 +44,35 @@ mac-7 hosts the dedicated automation Chrome instance.
 - Validation:
   - `http://127.0.0.1:9333/json/version` returns standard CDP metadata and `webSocketDebuggerUrl`
 
-### Current tailnet-facing listener status
+### Persistent tailnet-facing listener
 
-Observed on 2026-03-18:
+Validated on 2026-03-18:
 
 - Tailscale IP on mac-7: `100.64.0.23`
-- A temporary Python TCP proxy was listening on:
-  - `100.64.0.23:9223`
-- That proxy was forwarding toward a Chrome debug port for network reachability testing.
+- Persistent tailnet listener: `100.64.0.23:9223`
+- Forward target: `127.0.0.1:9333`
+- LaunchAgent:
+  - `~/Library/LaunchAgents/com.lingyuzeng.chrome-cdp-tailnet-proxy-mac7.plist`
+- Proxy script:
+  - `~/.openclaw/bin/chrome_cdp_tailnet_proxy.py`
+- Validation:
+  - `http://100.64.0.23:9223/json/version` returns `200 OK`
+  - returned `webSocketDebuggerUrl` is reachable on the tailnet-facing endpoint
 
 ### Important caveat
 
-The `100.64.0.23:9223` listener was observed as a temporary proxy, not yet confirmed as a durable/persistent service managed by LaunchAgent or `tailscale serve`.
+`tailscale serve` is not the active solution here.
 
-Also, `tailscale serve status` showed:
+Observed status:
 
-- `No serve config`
+- `tailscale serve status` => `No serve config`
+
+The durable implementation is instead LaunchAgent + Python TCP proxy.
 
 So future tasks should treat the endpoints as:
 
 - **stable local automation endpoint on mac-7:** `127.0.0.1:9333`
-- **temporary observed tailnet endpoint on mac-7:** `100.64.0.23:9223`
+- **stable tailnet remote endpoint on mac-7:** `100.64.0.23:9223`
 
 ## Usage guidance