test: run real-browser tests against the real binary cache

Tests marked slow or real_browser skip the per-test temp cache and use
~/.cloakbrowser like a real install: the developer's key and latest
binary at a stable path. The temp cache re-downloaded the keyless
binary for every test under a new path, which path-keyed firewalls
re-prompt for. Unit tests stay isolated.

pyproject.toml

@@ -74,4 +74,7 @@ path = "cloakbrowser/_version.py"
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 asyncio_mode = "auto"
-markers = ["slow: marks tests that hit live detection sites (deselect with '-m \"not slow\"')"]
+markers = [
+    "slow: marks tests that hit live detection sites (deselect with '-m \"not slow\"')",
+    "real_browser: launches the real binary from the real ~/.cloakbrowser cache (not isolated)",
+]

tests/conftest.py

@@ -4,7 +4,7 @@ import pytest
 
 
 @pytest.fixture(autouse=True)
-def isolated_cache_dir(tmp_path_factory, monkeypatch):
+def isolated_cache_dir(request, tmp_path_factory, monkeypatch):
     """Keep the suite away from the developer's real ``~/.cloakbrowser``.
 
     A ``license.key`` (or a cached Pro version marker) in the real cache dir
@@ -12,7 +12,14 @@ def isolated_cache_dir(tmp_path_factory, monkeypatch):
     headless ``no_viewport`` shim and inline proxy auth — tests then assert
     against whatever the developer happens to have installed. ``monkeypatch``
     means a test setting its own ``CLOAKBROWSER_CACHE_DIR`` still wins.
+
+    Real-browser tests (``slow`` / ``real_browser``) opt out and run like a user
+    machine: the developer's key and latest binary, at a stable path. A fresh
+    temp cache per test re-downloads the keyless binary every test, and its new
+    path re-prompts path-keyed firewalls (LuLu) since the binary is ad-hoc signed.
     """
+    if request.node.get_closest_marker("slow") or request.node.get_closest_marker("real_browser"):
+        return
     monkeypatch.setenv(
         "CLOAKBROWSER_CACHE_DIR",
         str(tmp_path_factory.mktemp("cloakbrowser-cache")),

tests/test_launch.py

@@ -10,6 +10,8 @@ from cloakbrowser import (
 )
 from cloakbrowser.config import get_chromium_version
 
+pytestmark = pytest.mark.real_browser
+
 
 @pytest.mark.parametrize("env", [None, "patchright"])
 def test_removed_backend_kwarg_raises(env, monkeypatch):

tests/test_stealth.py

@@ -29,6 +29,7 @@ def page(browser):
     p.close()
 
 
+@pytest.mark.real_browser
 class TestWebDriverDetection:
     """Tests for WebDriver/automation detection signals."""