fix(desktop): walk cross-realm shadow roots when resolving upload targets

resolveFileInputTarget climbed out of shadow roots with `root instanceof ShadowRoot`.
Elements in same-origin iframes belong to the frame's realm, so the check was false
for their shadow roots and the ancestor walk stopped at the shadow boundary, failing
browser_upload_file with "no nearby file input". Use the file's duck-typed
`'host' in root` idiom like every other shadow-host hop.

Author: waleedlatif1

apps/desktop/src/main/browser-agent/page-functions.test.ts

@@ -912,6 +912,21 @@ describe('collectSnapshot', () => {
     expect(captured.input.ownerDocument).toBe(document)
   })
 
+  it('climbs out of a shadow root inside a same-origin frame to find the file input', () => {
+    const frame = document.createElement('iframe')
+    document.body.append(frame)
+    const childDocument = frame.contentDocument as Document
+    childDocument.body.innerHTML = '<div id="host"></div><input type="file">'
+    const host = childDocument.getElementById('host') as HTMLElement
+    const button = childDocument.createElement('button')
+    host.attachShadow({ mode: 'open' }).append(button)
+    const input = childDocument.querySelector('input') as HTMLInputElement
+    register(button)
+
+    expect(button.getRootNode()).not.toBeInstanceOf(ShadowRoot)
+    expect(resolveFileInputTarget(0)).toEqual({ input, document: childDocument })
+  })
+
   it('refuses a disconnected or stale upload reference', () => {
     const input = document.createElement('input')
     input.type = 'file'

apps/desktop/src/main/browser-agent/page-functions.ts

@@ -3348,7 +3348,7 @@ export function resolveFileInputTarget(id: number): {
       )
     if (candidates.length === 1) input = candidates[0]
     const root = scope.getRootNode()
-    scope = scope.parentElement ?? (root instanceof ShadowRoot ? root.host : null)
+    scope = scope.parentElement ?? ('host' in root ? (root.host as Element) : null)
   }
   if (!input) throw new Error('The selected element has no nearby file input.')
   if (input.matches(':disabled')) throw new Error('The file input is disabled.')