test(ci): pin the Playwright browser setup both e2e jobs depend on

[hivecommons-hive]

Test Improvement

.github/workflows/ci.yml gets its Playwright setup right in both browser jobs
— e2e and e2e-coverage — and nothing held it there. This PR adds the
contract; it changes no workflow and no production code.

Two properties, both already true at main and both unpinned until now:

1. The browser's OS packages are installed on both sides of the
   ms-playwright cache. actions/cache restores the bundle, never the
   packages — those live in the runner image — which is why each job pairs
   --with-deps on a cache miss with install-deps on a cache hit. Drop the
   hit-branch step and the first run is still green; every later run fails as
   browserType.launch: Target page, context or browser has been closed,
   naming neither the missing library nor the skipped step. That is the exact
   symptom tests/contributing-e2e-setup.test.mjs:44-51 already records.
2. The browser cache key moves with the dependency. The key resolves
   @playwright/test out of package-lock.json; a key that does not change
   when the package does restores the previous release's browser and skips the
   install that would have replaced it, so a version bump silently drives an old
   binary.

tests/ci-playwright-setup.test.mjs follows the scanner idiom of
tests/helpers-ci-supply-chain.mjs: each scanner runs over the real
.github/workflows/** tree, which must be clean, and over synthetic
documents that do offend, so a scanner that stopped detecting cannot leave the
contract green. Deliberate scoping, stated in the file:

• a job that only installs the browser has nothing to launch and is not held
  to the suite contract;
• an install guarded on a condition the scanner does not recognise is reported
  rather than guessed at, so rewriting the guard cannot quietly disable the
  check;
• runner.os alone does not satisfy the key contract: it moves with the image,
  not with the package;
• both real-tree assertions first assert that a Playwright job (resp. a cached
  bundle) still exists, so the contract cannot pass by finding nothing.

Verification

At 4184f33, node v26.10.0, TZ=UTC:

• node --test tests/ci-playwright-setup.test.mjs → 11 tests, 0 failures.
• Non-vacuity, against the real ci.yml (mutated, asserted, reverted):
  deleting both Install Playwright system dependencies steps fails the first
  contract naming ci.yml (e2e) and ci.yml (e2e-coverage); replacing both
  keys with playwright-${{ runner.os }} fails the second, naming the same two
  jobs. Before this PR, both mutations leave the entire suite green.
• npm run test:unit:coverage:check (full gate flags) → 2328 tests, 0
  failures, exit 0; src files | 100.00 | 100.00 | 9135/9135 lines | 2753/2753 regions unchanged.
• npx prettier --check clean; npm run check:spelling → 0 issues.

Related Issue

Closes #1300

---

Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.