Browser2 page inspection exposes live input values, including password fields

Hi Rowboat team — I found a privacy-sensitive issue in the Browser2 page-inspection logic. The current Browser2 helper code can surface live input values as labels / verification payloads, including password field contents.

### Affected area
- Browser2 branch / Browser2 release line (`v0.2.8`–`v0.2.11`)

### Code path
- `apps/x/apps/main/src/browser/page-scripts.ts`
- `getElementLabel()` falls back to `element.value` when no better label exists
- `getVerificationTargetState()` captures raw `value` for inputs / textareas / selects / contenteditable elements
- these values then flow into page-read / verification output

### Local repro
I validated this with a local fixture page containing an email input, password input, and textarea. The Browser2 logic surfaced the live values directly:

```text
ROWBOAT_LEAK_RECHECK {"labels":[{"id":"email","type":"email","label":"alice@example.com","rawValue":"alice@example.com"},{"id":"pwd","type":"password","label":"super-secret-password","rawValue":"super-secret-password"},{"id":"notes","type":"textarea","label":"confidential draft","rawValue":"confidential draft"}],"passwordVerification":{"selector":"#pwd","descriptor":"input \"super-secret-password\"","text":null,"checked":null,"value":"super-secret-password","selectedIndex":null,"open":null,"disabled":false,"active":false,"ariaChecked":null,"ariaPressed":null,"ariaExpanded":null}}
```

### Why I think this matters
For unlabeled or minimally labeled fields, Browser2 can leak the actual typed content into tool-visible/model-visible output. That includes passwords, tokens, email drafts, and similar secrets.

### Suggested direction
- never use `element.value` as an automatic label fallback
- always redact password fields
- consider redacting all freeform input/textarea values unless the user explicitly requested value inspection
- prefer `aria-label`, associated ``, or `placeholder`, and otherwise return `null`

I also have a narrow redaction fix branch ready if that would be useful.

Start in apps/x/apps/main/src/browser/page-scripts.ts and inspect getElementLabel() and getVerificationTargetState(), following how input values reach page-read and verification output. Reproduce the reported fixture behavior, then verify that labels do not fall back to live values and that sensitive input values, especially passwords, are redacted or omitted as intended.

Written by the indexing model from the issue text.