Deferred review finding: browse/src/routes/commands.ts:172 — screenshot <bare tag> parses as an output path, so the tunn #4120

Filed by /ship's pre-landing review of PR #4116 (head 6574c9d). The finding is in code that PR did not change, so it was deferred here instead of being fixed there (review scope frozen after pass 1).

• Severity: CRITICAL
• Where: browse/src/routes/commands.ts:172
• Finding: screenshot parses as an output path, so the tunnel 403 hint says it cannot name an output path; hint could mention --selector. Fails closed. Reader: FIXABLE, Low, Blocks: no.