workshop/siteboss: browser auto-open fails on headless/SSH sessions (Raspberry Pi, DGX)

Bug: workshop login and workshop supply (Sigstore) fail to open browser

Environment

• Ubuntu 24.04 on NVIDIA DGX Spark (aarch64)
• Firefox installed via snap
• Session via SSH / terminal without X11 forwarding
• xdg-open returns exit 4: "cannot open display"

Problem

Both workshop login and workshop supply (Sigstore/Fulcio signing) attempt to open a browser via xdg-open, which fails silently or errors on:

1. SSH sessions without X11 forwarding (common for headless servers, Raspberry Pi, DGX)
2. Snap-installed browsers where xdg-open can't communicate with the sandboxed browser
3. Sessions without DISPLAY set (e.g., tmux, screen, systemd services)

The URLs are printed to stdout, but by the time the user notices and manually opens them, the PKCE challenge or device code has often expired.

Expected behavior

workshop login / workshop supply should:

1. Detect when xdg-open will fail (no DISPLAY, headless, SSH) before attempting it
2. Prominently display the URL with clear instructions to open manually
3. Try alternative browser commands (firefox, chromium-browser, chromium, google-chrome, sensible-browser) if xdg-open fails
4. Respect $BROWSER env var as a fallback
5. Consider a --no-browser flag that only prints the URL (for CI/headless use)

Steps to reproduce

# SSH into a Raspberry Pi or DGX Spark
workshop login --registry buildeverything
# Browser never opens, device code expires after 120s

workshop supply --tag v0.1.0
# Sigstore OAuth URL printed but browser never opens, PKCE expires

Workaround

Manually copy/paste the URL quickly, but this is error-prone with short-lived PKCE challenges.

Impact

This blocks the entire publish → run workflow on headless machines, which are a primary demo target (Raspberry Pi + DGX Spark running the same WASM binary).

🤖 Generated with Claude Code