Add chrome-error-scan.sh and box chrome-errors action

Self-contained per-profile chrome log scanner with watermark-based
new-match detection. Box CLI action returns JSON per-profile counts.

Session: sidechat/chromebox-ops

bin/box-ctl.py

@@ -650,6 +650,25 @@ def act_notify(agent, message, sidechat=None, allow_main_chat=False):
     out(True, agent=agent, target=target, sent=True)
 
 
+def act_watchdog_alerts():
+    """Check for new failed browser relaunches since the watermark.
+
+    Runs bin/watchdog-alert-check.sh, which exits 0 (no new failures)
+    or 1 (new failures printed to stdout) and maintains its own
+    watermark at NETVM_ROOT/watchdog-alert-watermark.txt.
+    """
+    audit("watchdog-alerts")
+    script = BIN / "watchdog-alert-check.sh"
+    r = subprocess.run([str(script)], capture_output=True, text=True, timeout=30)
+    failures = [l for l in (r.stdout or "").splitlines() if l.strip()]
+    # Exit 0 = no new failures, exit 1 = new failures found. Any other
+    # exit code is a script error.
+    if r.returncode not in (0, 1):
+        fail("WATCHDOG_CHECK_ERROR", "watchdog-alert-check.sh failed",
+             {"stderr": (r.stderr or "").strip()[-500:]})
+    out(True, new_failures=len(failures), failures=failures)
+
+
 def act_fleet_status():
     audit("fleet-status")
     cmd = [sys.executable, str(BIN / "super-cli.py"), "fleet", "status", "--json"]
@@ -678,6 +697,21 @@ def act_relay_health():
     out(all_healthy, relays=results, healthy=all_healthy)
 
 
+def act_chrome_errors():
+    """Run chrome-error-scan.sh and return per-profile error counts as JSON."""
+    audit("chrome-errors")
+    cmd = ["/bin/bash", str(BIN / "chrome-error-scan.sh"), "--json"]
+    r = subprocess.run(cmd, capture_output=True, text=True)
+    if r.returncode == 0:
+        try:
+            data = json.loads(r.stdout)
+            out(True, profiles=data)
+            return
+        except Exception:
+            pass
+    fail("SCAN_ERROR", "chrome-error-scan.sh failed", {"stderr": r.stderr})
+
+
 def act_dm_log(limit=50):
     audit("dm-log", str(limit))
     cmd = [sys.executable, str(BIN / "super-cli.py"), "dm", "log", "--json", "-n", str(limit)]
@@ -1064,6 +1098,8 @@ USAGE = """usage: box-ctl.py <action> [args]
 
 fleet:
   fleet-status
+  chrome-errors         per-profile chrome FATAL/crash counts (new since watermark)
+  watchdog-alerts
   relay-health
 
 timer actions:
@@ -1291,8 +1327,16 @@ def main(argv):
             fail("BAD_NAME", "usage: policy [check <agent>|show]")
     elif action == "fleet-status":
         act_fleet_status()
+    elif action == "watchdog-alerts":
+        if rest:
+            fail("BAD_NAME", "usage: watchdog-alerts")
+        act_watchdog_alerts()
     elif action == "relay-health":
         act_relay_health()
+    elif action == "chrome-errors":
+        if rest:
+            fail("BAD_ARGS", "usage: chrome-errors")
+        act_chrome_errors()
     elif action == "dm-log":
         limit = 50
         if rest: