fix(web-access): 强制 Windows 隔离 Playwright 环境 (#96)

## 中文

- 将 web-access 升级到 v3.4.2。
- L3-external 必须先创建或选择 DesireCore 隔离 venv，再进行 import、固定版本安装、复检和 CDP
attach。
- Windows 全流程只允许 PowerShell 与 venv 的 Scripts\\python.exe；禁止 Bash、裸
python/pip、pip --user、全局安装和 playwright install。
- 修正中英文 L3 汇总表，避免后置表格覆盖前置安全规则。

验证：完整 i18n validator、translation freshness、validator unit 均通过；独立复审无
P0-P2。

## English

- Bump web-access to v3.4.2.
- Require creating or selecting the DesireCore-owned isolated venv
before import checks, pinned installation, re-check, and CDP attach.
- On Windows, require PowerShell and the venv Scripts\\python.exe
throughout; forbid Bash, bare python/pip, pip --user, global
installation, and playwright install.
- Align both localized L3 summary tables so later guidance cannot
override the safety contract.

Validation: full i18n validation, translation freshness, and validator
unit tests pass; independent review found no P0-P2 findings.

skills/web-access/references/cdp-browser.md

@@ -339,13 +339,17 @@ fi
 #### Windows hosts
 
 Use the `PowerShell` tool. Resolve `<DESIRECORE_HOME>` from the current DesireCore instance; do not
-guess another instance's directory.
+guess another instance's directory. The only permitted system/bootstrap `python.exe` use is running
+`-m venv` when the isolated venv is missing. Never use the `Bash` tool, bare `python`, bare `pip`,
+`pip --user`, or a global interpreter for any Playwright import, install, re-check, or attach step;
+all of those steps must use the venv's `Scripts\python.exe`.
 
 ```powershell
 $venv = Join-Path '<DESIRECORE_HOME>' 'runtime\external-browser-playwright'
 $python = Join-Path $venv 'Scripts\python.exe'
 if (-not (Test-Path -LiteralPath $python)) {
-    python -m venv $venv
+    $bootstrapPython = (Get-Command python.exe -ErrorAction Stop).Source
+    & $bootstrapPython -m venv $venv
     if ($LASTEXITCODE -ne 0) { throw 'Failed to create the isolated Playwright venv.' }
 }
 & $python -c "import playwright"