ci: drop the Firefox smoke job; keep the engines as an on-demand tool

The job was trialled and did not earn its place. It was genuinely cheap —
~2 minutes, running in parallel with the 15-minute build job, so zero
added wall-clock — but across a dozen runs Firefox never once disagreed
with Chromium. It was paying runner time and carrying a real flake
surface (playwright install --with-deps runs apt-get update, which fails
whenever a third-party repo in the runner image breaks; that is what the
one red run was) to re-confirm a result already in hand.

Everything that made cross-engine checking possible stays: SMOKE_BROWSER,
the shared headless-browser helper, the installer, and the tests. So
"SMOKE_BROWSER=firefox npm run smoke:web:engine" is there for the moment
it is worth running — before touching the sandbox, the CSP builder or the
proxy page — without taxing every push to re-derive the same answer.

The workflow is now byte-identical to v2/main again; the publish jobs go
back to needing only build.

Docs say what is true rather than what was intended, and AGENTS.md
records the reasoning so the job is not re-added on the general argument
that cross-engine coverage is good — that argument was already accepted,
and the on-demand path is what serves it. Re-add it on evidence: a real
cross-engine regression a gate would have caught.

Also swept the now-stale "matrix" language out of the smokes and the
resolver, including the empty-SMOKE_BROWSER rationale, which no longer
leans on a matrix key that does not exist.

Signed-off-by: cliffhall <cliff@futurescale.com>

.github/workflows/main.yml

@@ -28,8 +28,8 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "22.x"
-          cache: "npm"
+          node-version: '22.x'
+          cache: 'npm'
 
       - name: Install dependencies (root + all clients)
         # The root postinstall (scripts/install-clients.mjs) cascades
@@ -115,86 +115,6 @@ jobs:
         working-directory: ./clients/web
         run: npm run test:storybook
 
-  # The same headless web smokes the `build` job already runs in Chromium, run
-  # again in the other engines this repo supports (#2086).
-  #
-  # Why this is a job of its own rather than a matrix over `build`: `build` also
-  # runs validate, the coverage gate, two verify gates and Storybook, none of
-  # which are engine-dependent — matrixing it would triple all of that to gain
-  # three browser smokes. Chromium is deliberately NOT in the matrix here for
-  # the same reason: `npm run smoke` inside `build` is exactly the local
-  # `npm run ci` path, and it already covers it. Supported set = the Chromium run
-  # there plus whatever the matrix below names.
-  #
-  # This is the only place the MCP Apps sandbox is exercised on a non-Chromium
-  # engine — which is why Firefox is gated here rather than assumed to behave
-  # like Chromium.
-  #
-  # The unit tests cannot substitute — `sandbox-csp.test.ts` asserts
-  # which policy STRING is built, which passes identically on an engine that
-  # ignores `<meta>` CSP entirely — and no Storybook story reaches the sandbox at
-  # all (all three App stories use a `data:` placeholder iframe and a mock
-  # bridge). Note Playwright's WebKit is a WebKit build, not Safari: close enough
-  # to catch engine-level CSP and iframe divergence, not close enough to certify
-  # Safari.
-  browser-engine-smokes:
-    runs-on: ubuntu-latest
-    strategy:
-      # Kept on despite the matrix currently holding one engine: the moment a
-      # second is added back (see below), failing fast would hide one engine's
-      # regression behind another's — which is the exact distinction this job
-      # exists to draw, so the flag should not have to be remembered then.
-      fail-fast: false
-      matrix:
-        # `webkit` belongs here and is deliberately absent: the smokes RUN in it
-        # (`SMOKE_BROWSER=webkit` works, and smoke:web:browser passes), but the
-        # two App smokes fail there for reasons nobody has identified. It does
-        # NOT reproduce in real Safari, and an isolated SSE repro did not
-        # reproduce it under Playwright's WebKit either, so it reads as a
-        # property of that build rather than a browser bug — and chasing it
-        # further was judged not worth the effort. Adding it here is a one-word diff once it is
-        # resolved. An engine is either green or absent; a `continue-on-error`
-        # job would report coverage nobody is holding to a standard.
-        browser: [firefox]
-    name: Sandbox smokes (${{ matrix.browser }})
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7
-        with:
-          node-version: "22.x"
-          cache: "npm"
-
-      - name: Install dependencies (root + all clients)
-        run: npm install
-
-      - name: Build all clients
-        # The smokes need clients/web/dist and the cli/tui/launcher bundles.
-        # `build` rather than `validate` — the format/lint/typecheck half is
-        # engine-independent and already ran in the `build` job.
-        run: npm run build
-
-      - name: Cache Playwright browsers
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ matrix.browser }}-${{ runner.os }}-${{ hashFiles('clients/web/package-lock.json') }}
-
-      - name: Install Playwright ${{ matrix.browser }}
-        working-directory: ./clients/web
-        # `--with-deps` for the system libraries a bare runner lacks; WebKit is
-        # the large download here and dominates this step.
-        run: npx playwright install --with-deps ${{ matrix.browser }}
-
-      - name: Run the headless web smokes in ${{ matrix.browser }}
-        # The set of smokes lives in the `smoke:web:engine` npm script, not
-        # enumerated here, so adding one covers every engine automatically.
-        env:
-          SMOKE_BROWSER: ${{ matrix.browser }}
-        run: npm run smoke:web:engine
-
   # Publish the single `@modelcontextprotocol/inspector` package to npm on a
   # published GitHub release. v2 is not an npm workspace, so there is no
   # `publish-all` / `--workspaces` (v1) — just one `npm publish`, whose `prepack`
@@ -207,7 +127,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
     environment: release
-    needs: [build, browser-engine-smokes]
+    needs: build
     # Serialize publishes so two releases cut in quick succession can't run
     # overlapping `npm publish`es. Never cancel an in-flight publish.
     concurrency:
@@ -225,9 +145,9 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: "22.x"
-          cache: "npm"
-          registry-url: "https://registry.npmjs.org"
+          node-version: '22.x'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Assert release tag matches package version
         # `npm publish` ships whatever `version` is in the root package.json,
@@ -300,7 +220,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
     environment: release
-    needs: [build, browser-engine-smokes]
+    needs: build
     permissions:
       contents: read
       packages: write