T10.7 - record the real browser-suite verification

url_state_check.py and browser_check.py both need a real headless browser via
tests/cdp.py, which the dev sandbox T10.7 was built in does not have and
cannot install (no sudo, network egress allowlisted against every route tried
- apt, a user-space Playwright Chromium download, Docker Hub). Documented as
an open gap in that commit rather than claimed as done.

Run for real since, on a machine with Docker, through a small general-purpose
tool kept deliberately outside this repo (headless-py-test-runner - it has no
idea what repo it is pointed at, so it does not belong in a Work Package Suite
PR). url_state_check.py 26/26, including scenario 2's actual click-through of
the fake-Okta round trip this task built; browser_check.py 71/71. Gap closed -
wave-10.md now says so instead of leaving the question open.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/waves/wave-10.md

@@ -86,6 +86,15 @@ Depends only on `main` as it stands after `D15`. Not sequenced behind any other
   surviving unchanged, same-site vs. off-site `?next=`, and `OKTA_IDENTITY_CLAIM`
   genuinely working under a non-default claim name — 22/22.
 
+  The dev sandbox this was built in has no headless browser and no way to install
+  one, so `tests/url_state_check.py` and `tests/browser_check.py` (both need
+  `tests/cdp.py`'s real headless Chromium) could not be run there — only
+  `okta_auth_check.py`'s HTTP-level coverage of the same mechanism. Run for real
+  afterward on a machine with Docker, via a separate general-purpose tool
+  (`headless-py-test-runner`, kept out of this repo — it is not Work Package Suite
+  specific): `url_state_check.py` 26/26, including scenario 2's real click-through of
+  the fake-Okta round trip, and `browser_check.py` 71/71. Gap closed.
+
 - **T10.8 — Verification.** 390px and 1440px, full suite, done-when checks per task,
   matching the rigor D13 was held to.