ci: drop the Firefox smoke job; keep the engines as an on-demand tool

The job was trialled and did not earn its place. It was genuinely cheap —
~2 minutes, running in parallel with the 15-minute build job, so zero
added wall-clock — but across a dozen runs Firefox never once disagreed
with Chromium. It was paying runner time and carrying a real flake
surface (playwright install --with-deps runs apt-get update, which fails
whenever a third-party repo in the runner image breaks; that is what the
one red run was) to re-confirm a result already in hand.

Everything that made cross-engine checking possible stays: SMOKE_BROWSER,
the shared headless-browser helper, the installer, and the tests. So
"SMOKE_BROWSER=firefox npm run smoke:web:engine" is there for the moment
it is worth running — before touching the sandbox, the CSP builder or the
proxy page — without taxing every push to re-derive the same answer.

The workflow is now byte-identical to v2/main again; the publish jobs go
back to needing only build.

Docs say what is true rather than what was intended, and AGENTS.md
records the reasoning so the job is not re-added on the general argument
that cross-engine coverage is good — that argument was already accepted,
and the on-demand path is what serves it. Re-add it on evidence: a real
cross-engine regression a gate would have caught.

Also swept the now-stale "matrix" language out of the smokes and the
resolver, including the empty-SMOKE_BROWSER rationale, which no longer
leans on a matrix key that does not exist.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/smoke-web-app.mjs

@@ -44,14 +44,15 @@
  * ── Which engine ────────────────────────────────────────────────────────────
  *
  * `SMOKE_BROWSER` picks the engine (`chromium` — the default — `firefox`, or
- * `webkit`). CI gates **Chromium** (in the `build` job's `npm run smoke`) and
- * **Firefox** (in the `Sandbox smokes` matrix job); WebKit runs here but is not
- * gated: this smoke fails under Playwright's WebKit for reasons nobody has
- * identified, and nobody is currently investigating. It does NOT reproduce in
- * real Safari, and an isolated SSE repro did not reproduce it in Playwright's
- * WebKit either — so it is a property of that build, not a browser bug, and it
- * was judged not worth chasing. Run WebKit locally if you want the signal; do
- * not read a failure here as a defect until someone has looked (#2086).
+ * `webkit`). **CI runs Chromium only.** The other engines are an on-demand tool,
+ * not a gate: `SMOKE_BROWSER=firefox npm run smoke:web:engine` before touching
+ * the sandbox is cheap and worth doing, but nothing runs it for you (#2086).
+ *
+ * Firefox passes. WebKit fails this smoke for reasons nobody has identified and
+ * nobody is investigating: it does not reproduce in real Safari, and an isolated
+ * SSE repro did not reproduce it under Playwright's WebKit either, so it reads
+ * as a property of that build rather than a browser bug. Do not read a WebKit
+ * failure here as a defect until someone has actually looked.
  *
  * This smoke is one of the two places the
  * MCP Apps sandbox is genuinely exercised, and the sandbox is built out of the
@@ -89,8 +90,8 @@ const repoRoot = resolve(import.meta.dirname, "..");
 
 // Resolved before anything is started, so an unsupported SMOKE_BROWSER fails
 // immediately rather than after a web server and two MCP servers are up. Every
-// message this smoke prints carries the engine, so a matrix failure names which
-// one broke without the reader having to match it to a job title.
+// message this smoke prints carries the engine, so a failure names which one
+// broke rather than leaving the reader to remember what they invoked it with.
 let BROWSER;
 try {
   BROWSER = resolveBrowserName();