You’ve got it: the core service listens for inbound Upgrade http requests, starts a browser, then funnels the connection into the browser.
This debugger simply sits on top of all that, and puts the code/execution context in the browser versus the server. Cloud flare is simply detecting that our server IP is a known headless chrome instance, and is serving their bot detection check