homepage redesign + docs cleanup + agent prompting (#540)

* homepage redesign + docs cleanup + agent prompting improvements

- rewrote hero section: new tagline, responsive font sizing with clamp(),
  extracted shared constants for copy management
- added feature screenshots (shell isolation, github permissions, mcp tools,
  agent browser) and ensured consistent image sizing
- reworked feature section mobile layout: caption-style descriptions, bigger
  h3s, image padding
- made CTA buttons visible on all breakpoints (stacked on mobile, row on md+)
- reorganized docs/tools.mdx into single table with category dividers,
  simplified tool descriptions
- added markdown image syntax instruction to agent system prompt
- fixed InfoPopover overflow on small screens
- misc: InlineCode proportional sizing, OnboardingCard updates, shell/security
  doc improvements

Made-with: Cursor

* update pnpm-lock.yaml for agent-browser 0.25.4

Made-with: Cursor

mcp/shell.ts

@@ -65,7 +65,7 @@ function detectSandboxMethod(): SandboxMethod {
     // continue to try sudo
   }
 
-  // try sudo unshare (works on GHA runners)
+  // sudo unshare (works on GHA runners)
   try {
     const result = spawnSync("sudo", ["unshare", "--pid", "--fork", "--mount-proc", "true"], {
       timeout: 5000,
@@ -81,7 +81,7 @@ function detectSandboxMethod(): SandboxMethod {
   }
 
   detectedSandboxMethod = "none";
-  log.info("PID namespace isolation not available - falling back to env filtering only");
+  log.info("PID namespace isolation not available");
   return "none";
 }
 
@@ -97,6 +97,13 @@ const PROC_CLEANUP =
 function spawnShell(params: SpawnParams): ChildProcess {
   const spawnOpts = { env: params.env, cwd: params.cwd, stdio: params.stdio, detached: true };
   const sandboxMethod = detectSandboxMethod();
+  const ci = process.env.CI === "true";
+
+  if (ci && sandboxMethod === "none") {
+    throw new Error(
+      "pid namespace isolation is required in CI but unavailable (both unshare and sudo unshare failed)"
+    );
+  }
 
   if (sandboxMethod === "unshare") {
     return spawn(