feat(find-url): search local Chrome/Edge bookmarks by keyword

Borrow web-access's find-url: locate an internal system or a previously-saved
page that public search can't reach, without opening a browser.

- `agent-browser find-url <keywords> [--browser chrome|edge] [--profile X]
  [--limit N] [--json]` — local command, no daemon. All keywords must match a
  bookmark's name or url; results are most-recently-added first.
- Cross-platform Bookmarks JSON paths (macOS / Linux / Windows), zero new deps
  (serde_json). Skips javascript:/data: bookmarklets.
- Skill docs: "pick the cheapest tool" matrix now points at find-url, plus a
  commands.md section.

Bookmarks only for now — visited-history is a locked SQLite DB and would need a
SQLite dependency (deferred to avoid C-dep cross-compile risk in the release
pipeline).

skill-data/core/references/commands.md

@@ -336,6 +336,22 @@ agent-browser profiler start              # Start Chrome DevTools profiling
 agent-browser profiler stop trace.json    # Stop and save profile
 ```
 
+### Finding a page the user saved (`find-url`)
+
+Search the user's local Chrome/Edge **bookmarks** by keyword — for internal
+systems or previously-saved pages that public search can't reach. Local read, no
+browser/daemon needed.
+
+```bash
+agent-browser find-url jira board          # all keywords must match (name or url)
+agent-browser find-url --limit 10 invoices
+agent-browser find-url --browser edge --profile "Profile 1" wiki
+agent-browser find-url grafana --json      # {results:[{name,url,folder}], count}
+```
+
+Results are most-recently-added first. `javascript:`/`data:` bookmarklets are
+skipped. (Visited-history search isn't included yet — bookmarks only.)
+
 ### Debugging forms / hidden state with `eval`
 
 The a11y `snapshot` shows visible, interactive elements — it does **not** show