feat(python): add galaxy-browse CLI subcommand (§4.6)

clients/python/README.md

@@ -216,13 +216,14 @@ cancelling the surrounding task closes the underlying gRPC stream
 cleanly. The streaming RPC requires the same `metadata:read` scope as
 the other Galaxy methods.
 
-The CLI exposes the Galaxy Repository RPCs through four subcommands that
+The CLI exposes the Galaxy Repository RPCs through five subcommands that
 mirror the other clients:
 
 ```bash
 mxgw-py galaxy-test-connection --plaintext --json
 mxgw-py galaxy-last-deploy --plaintext --json
 mxgw-py galaxy-discover --plaintext --json
+mxgw-py galaxy-browse --plaintext --json
 mxgw-py galaxy-watch --plaintext --json
 ```
 
@@ -231,6 +232,16 @@ mxgw-py galaxy-watch --plaintext --json
 ISO-8601 timestamp) to suppress the bootstrap event when it matches the
 current cached deploy time.
 
+`galaxy-browse` wraps the lazy `LazyBrowseNode` walker. Without `--depth`
+it lists only the root objects; `--depth N` eagerly expands `N` further
+levels before printing. Text output is a node count followed by an indented
+tree (`+`/`-` marks the server's has-children hint); `--json` emits nested
+`{..., "hasChildrenHint": bool, "children": [...]}` nodes that match the
+`galaxy-discover` object shape. The `BrowseChildrenRequest` filters are
+exposed as `--category-id` (repeatable), `--template-chain-contains`
+(repeatable), `--tag-name-glob`, `--include-attributes`,
+`--alarm-bearing-only`, and `--historized-only`, all AND-combined.
+
 ## Authentication And TLS
 
 `ClientOptions.api_key` adds this metadata to unary calls and streams: