fix(browser): unify SSRF guard path for navigation

src/browser/pw-tools-core.snapshot.ts

@@ -1,4 +1,6 @@
+import type { SsrFPolicy } from "../infra/net/ssrf.js";
 import { type AriaSnapshotNode, formatAriaSnapshot, type RawAXNode } from "./cdp.js";
+import { assertBrowserNavigationAllowed } from "./navigation-guard.js";
 import {
   buildRoleSnapshotFromAiSnapshot,
   buildRoleSnapshotFromAriaSnapshot,
@@ -158,11 +160,16 @@ export async function navigateViaPlaywright(opts: {
   targetId?: string;
   url: string;
   timeoutMs?: number;
+  ssrfPolicy?: SsrFPolicy;
 }): Promise<{ url: string }> {
   const url = String(opts.url ?? "").trim();
   if (!url) {
     throw new Error("url is required");
   }
+  await assertBrowserNavigationAllowed({
+    url,
+    ssrfPolicy: opts.ssrfPolicy,
+  });
   const page = await getPageForTargetId(opts);
   ensurePageState(page);
   await page.goto(url, {