test(smoke): run the headless web smokes in Firefox and WebKit, not just Chromium (#2086)

Every browser-driven check in this repo launched Chromium and nothing else.
That is fine for most of the web client, whose behavior is React and Mantine.
It is not fine for the MCP Apps sandbox, which is built out of the primitives
that genuinely diverge between engines: a CSP <meta> injected as the first
<head> child of a srcdoc document, a nested sandboxed iframe, a
Permissions-Policy allow attribute, and postMessage origin discipline across
those two frames. Nothing else covers that surface — sandbox-csp.test.ts
asserts which policy STRING is built (environment-independent by
construction), and no Storybook story reaches the sandbox at all, since all
three App stories use a data: placeholder iframe and a mock bridge.

The engine is now a parameter:

  SMOKE_BROWSER=webkit npm run smoke:web:app
  SMOKE_BROWSER=firefox npm run smoke:web:engine   # all three smokes

Unset means chromium, so `npm run ci` and `npm run smoke` are unchanged. An
unrecognized value is an error rather than a fallback — falling back would
report a green Chromium run under a job labelled "webkit", claiming coverage
that never ran — and a launch failure names the engine that failed and its own
`playwright install` invocation.

Selection, launching, and the fatal-vs-benign page-diagnostics split now live
in one shared scripts/lib/headless-browser.mjs. The three smokes had each
hand-rolled the diagnostics split and two had their own copy of loadChromium;
pack:verify goes through the same helper, pinned to Chromium explicitly since
it is a packaging check.

The npm scripts drop their `cd clients/web && npx playwright install chromium`
prefix for scripts/install-smoke-browser.mjs. The engine is a variable now, and
a ${VAR:-default} expansion does not expand under Windows' cmd.exe; npx is also
a .cmd shim there that a shell-free spawn cannot start, so this resolves the
Playwright CLI through resolveNodeBin — the #1939 problem solved the #1939 way.

CI gains a `Sandbox smokes (<engine>)` matrix job rather than matrixing `build`,
which also runs validate, the coverage gate, two verify gates and Storybook —
all engine-independent. Both publish jobs now need it.

WebKit is supported by the tooling but deliberately NOT in the CI matrix yet:
pointing the smokes at it immediately found #2132, a pre-existing Safari
incompatibility in the web client's SSE transport that strands the last message
on /api/mcp/events, so an MCP App never leaves "loading". That is a product bug
affecting real Safari users, with its own diagnosis and a verified fix, and it
is not a matrix change. Adding `webkit` here is a one-word diff once it lands.
An engine is either green in CI or absent from it; a continue-on-error job would
report coverage nobody is held to.

Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/smoke-web-app.mjs

@@ -41,6 +41,16 @@
  * renamed* without its reader being updated, a repo-tree failure pack:verify
  * would only find later.
  *
+ * ── Which engine ────────────────────────────────────────────────────────────
+ *
+ * `SMOKE_BROWSER` picks the engine (`chromium` — the default — `firefox`, or
+ * `webkit`); CI runs all three (#2086). This smoke is one of the two places the
+ * MCP Apps sandbox is genuinely exercised, and the sandbox is built out of the
+ * primitives that actually diverge between engines — `srcdoc` CSP inheritance,
+ * nested sandboxed iframes, `Permissions-Policy`, cross-frame `postMessage`. See
+ * `lib/headless-browser.mjs`, including why a green WebKit run is not a Safari
+ * guarantee.
+ *
  * Expects `clients/web/dist` and `clients/launcher/build` to be built first —
  * the validate / CI ordering guarantees this. `test-servers/build` is rebuilt on
  * every run, as in smoke:cli — see `scripts/lib/ensure-test-servers.mjs` for why
@@ -54,17 +64,34 @@ import { join, resolve } from "node:path";
 import { startProdWebServer } from "./lib/prod-web-server.mjs";
 import { stopChild } from "./lib/child-cleanup.mjs";
 import {
-  APP_TOOL,
   attachPageDiagnostics,
+  loadBrowser,
+  resolveBrowserName,
+} from "./lib/headless-browser.mjs";
+import {
+  APP_TOOL,
   buildAppDeepLink,
   driveAppFlow,
-  loadChromium,
   sandboxProxyPageFor,
   startMcpAppServer,
 } from "./lib/mcp-app-flow.mjs";
 
 const repoRoot = resolve(import.meta.dirname, "..");
-const LABEL = "smoke:web:app";
+
+// Resolved before anything is started, so an unsupported SMOKE_BROWSER fails
+// immediately rather than after a web server and two MCP servers are up. Every
+// message this smoke prints carries the engine, so a matrix failure names which
+// one broke without the reader having to match it to a job title.
+let BROWSER;
+try {
+  BROWSER = resolveBrowserName();
+} catch (err) {
+  console.error(
+    `smoke:web:app FAILED — ${err instanceof Error ? err.message : String(err)}`,
+  );
+  process.exit(1);
+}
+const LABEL = `smoke:web:app [${BROWSER}]`;
 
 // Resolved exactly as the runtime does, from the built runner's directory.
 const sandboxProxyPage = sandboxProxyPageFor(
@@ -141,7 +168,7 @@ try {
     label: LABEL,
   });
   await server.waitForReady();
-  browser = await loadChromium(repoRoot);
+  browser = await loadBrowser(repoRoot, BROWSER);
   const page = await browser.newPage();
   const diagnostics = attachPageDiagnostics(page);