Fix Xvfb headed Turnstile path for headless servers

- start.sh: never inject empty DISPLAY= into xvfb-run children
  (was forcing Python headless and killing Turnstile)
- headed Chromium uses base flags only; headless-only flags
  (disable-software-rasterizer/gpu) no longer applied under Xvfb
- Align closer to Git-creat7/grokRegister-cpa headed+extension path

grok_register_ttk.py

@@ -613,18 +613,28 @@ def add_token_to_grok2api_pools(raw_token, email="", log_callback=None):
     _add_token_to_grok2api_pools_sync(raw_token, email=email, log_callback=log_callback)
 
 
-CHROMIUM_SLIM_FLAGS = [
-    "--disable-gpu",
-    "--disable-software-rasterizer",
+# Base flags always safe. Keep close to Git-creat7/grokRegister-cpa which only
+# uses auto_port + extension (no slim flags) on real headed desktops.
+CHROMIUM_BASE_FLAGS = [
     "--no-sandbox",
     "--disable-dev-shm-usage",
     # Keep images ON: Turnstile/CF widgets often need them; was a common fail cause.
     "--mute-audio",
-    "--disable-background-networking",
     "--no-first-run",
     "--disable-blink-features=AutomationControlled",
 ]
 
+# Extra flags only for true headless (no DISPLAY). Under Xvfb/headed these can
+# blank CF widgets (iframe=0 / token=0) — especially --disable-software-rasterizer.
+CHROMIUM_HEADLESS_EXTRA_FLAGS = [
+    "--disable-gpu",
+    "--disable-software-rasterizer",
+    "--disable-background-networking",
+]
+
+# Back-compat alias used by older call sites / register_cli patches
+CHROMIUM_SLIM_FLAGS = CHROMIUM_BASE_FLAGS + CHROMIUM_HEADLESS_EXTRA_FLAGS
+
 # Headless / display helpers (Linux servers without desktop)
 _HEADLESS_HINT_SHOWN = False
 _HEADLESS_HINT_LOCK = threading.Lock()
@@ -1060,8 +1070,14 @@ def create_browser_options(headless=None):
     options = ChromiumOptions()
     options.auto_port()
     options.set_timeouts(base=1)
-    for flag in CHROMIUM_SLIM_FLAGS:
+
+    # Decide headless first so we can choose flag set (headed ≈ reference repo).
+    use_hl = should_use_headless(headless, log_hint=True)
+    for flag in CHROMIUM_BASE_FLAGS:
         options.set_argument(flag)
+    if use_hl:
+        for flag in CHROMIUM_HEADLESS_EXTRA_FLAGS:
+            options.set_argument(flag)
     # Do NOT pass --excludeSwitches as a CLI arg (invalid); only real prefs.
     try:
         options.set_pref("credentials_enable_service", False)
@@ -1115,13 +1131,13 @@ def create_browser_options(headless=None):
         except Exception as e:
             print(f"  [proxy] set browser proxy failed: {e}")
 
-    use_hl = should_use_headless(headless, log_hint=True)
     apply_headless_to_options(options, use_hl)
     if use_hl:
         print("  [browser] headless=True", flush=True)
     else:
         print(
-            f"  [browser] headed DISPLAY={os.environ.get('DISPLAY', '')!r}",
+            f"  [browser] headed DISPLAY={os.environ.get('DISPLAY', '')!r} "
+            f"(flags=base-only, no disable-software-rasterizer)",
             flush=True,
         )
     return options