Stage 7: ui-test CI — make Playwright e2e strict

System libs are now provisioned once on the runner host (install-deps); the job
downloads the browser into the runner cache and runs the smoke strictly (no
--with-deps, no sudo, no continue-on-error; timeouts kept as a hang guard).

.gitea/workflows/ui-test.yaml

@@ -49,18 +49,16 @@ jobs:
       - name: Bundle-size budget
         run: node scripts/bundle-size.mjs
 
-      # The Gitea runner is an `act` host executor without apt privileges, so
-      # Playwright's `--with-deps` (apt-get) hangs. We download the browser only and
-      # run the smoke best-effort, bounded by a timeout: the strict gate above
-      # (check / unit / build / size) plus the hard local pre-push e2e cover the
-      # slice; this validates the browser path only when the host already has the
-      # required libraries. Run the job in a Playwright container to make it strict.
+      # The Playwright system libraries are provisioned once on the runner host
+      # (`sudo npx playwright@<version> install-deps chromium`), so the job needs no
+      # apt and no sudo: it only downloads the browser binary into the runner cache
+      # (persisted by the host executor) and runs the smoke. The timeouts guard
+      # against a future hang. Keep this in lockstep with @playwright/test in
+      # package.json — re-run install-deps on the host after a major bump.
       - name: Install Playwright browser
         run: pnpm exec playwright install chromium
         timeout-minutes: 5
-        continue-on-error: true
 
       - name: E2E smoke (mock)
         run: pnpm run test:e2e
         timeout-minutes: 5
-        continue-on-error: true