docs(smoke): state the actual CI browser coverage, not the intended one

The three smoke headers and one AGENTS.md bullet still said CI runs all
three engines. That was written before pointing the smokes at WebKit
found #2132; the matrix was then narrowed to Firefox and these were not
brought along, so they claimed a gate that does not exist. Each now says
what CI actually enforces — Chromium in the build job's `npm run smoke`,
Firefox in the Sandbox smokes matrix — and where WebKit stands.

smoke-web-browser.mjs additionally notes that IT passes in WebKit; the
two App smokes are the ones that do not, and a reader of this file should
not infer otherwise from a bare '#2132' reference.

The fail-fast: false rationale no longer cites a WebKit-vs-Firefox
example it cannot currently produce, and says why the flag is still right
for a one-entry matrix.

Addresses Copilot review on #2133.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/smoke-web-app.mjs

@@ -44,7 +44,12 @@
  * ── Which engine ────────────────────────────────────────────────────────────
  *
  * `SMOKE_BROWSER` picks the engine (`chromium` — the default — `firefox`, or
- * `webkit`); CI runs all three (#2086). This smoke is one of the two places the
+ * `webkit`). CI gates **Chromium** (in the `build` job's `npm run smoke`) and
+ * **Firefox** (in the `Sandbox smokes` matrix job); WebKit runs here but is not
+ * gated yet — it fails on #2132, a Safari incompatibility in the web client's
+ * SSE transport that this smoke is what found (#2086).
+ *
+ * This smoke is one of the two places the
  * MCP Apps sandbox is genuinely exercised, and the sandbox is built out of the
  * primitives that actually diverge between engines — `srcdoc` CSP inheritance,
  * nested sandboxed iframes, `Permissions-Policy`, cross-frame `postMessage`. See