test: containerized Firefox end-to-end harness (closes #184)

Drives the real popup in a real Firefox with dist/firefox/ installed as an
unpacked MV2 temporary add-on, via geckodriver. Covers popup load, wallet
creation through the UI, and the Add Token screen. Outside make check, like
the Chrome suite.

Zero npm dependencies: tests/e2e/firefox/driver.js is a WebDriver client
over global fetch and child_process against geckodriver's HTTP API. The
Dockerfile pins the node base image, the Firefox 153.0.3 tarball and
geckodriver 0.36.0 by digest.

Errors are read from the privileged nsIConsoleService in Marionette's chrome
context, filtered to non-warning entries whose sourceName is the extension
origin. BiDi log.entryAdded delivers nothing at all for extension pages, so
a Playwright-BiDi or Puppeteer-BiDi harness would see nothing and report
success; the code says so where someone would be tempted to simplify it.
This also captures background-page and content-script errors, verified by
probe rather than assumed.

No driver layer is shared with the Chrome suite and the three UI steps are
written twice deliberately: the two backends have no common substrate, and
three steps do not pay for a shim.

Two limits are documented rather than papered over. Error capture is
poll-based, so an error is attributed to a step and not to a moment within
it. Nothing is stubbed; the container runs with --network none instead,
which proves no request escaped but cannot report which were attempted.

tests/e2e/firefox/Dockerfile

@@ -0,0 +1,51 @@
+# Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
+# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
+# harness itself has no dependencies, so nothing is installed for it.
+#
+# All three external artifacts are pinned by digest. The Firefox version in
+# particular must not float: -remote-allow-system-access is mandatory on 153
+# and was not on 142, so the flag the harness passes is version-coupled.
+
+# node:22-bookworm-slim, 2026-08-12
+FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Firefox's shared-library dependencies on a slim base, plus the two tools
+# needed to fetch and unpack the pinned tarballs.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        libasound2 \
+        libdbus-glib-1-2 \
+        libgtk-3-0 \
+        libx11-xcb1 \
+        libxt6 \
+        libxtst6 \
+        xz-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+# Firefox 153.0.3, linux-x86_64, en-US
+ARG FIREFOX_URL=https://ftp.mozilla.org/pub/firefox/releases/153.0.3/linux-x86_64/en-US/firefox-153.0.3.tar.xz
+ARG FIREFOX_SHA256=22b312280900bfb174b685ece32c7b3c6d72e7f8e53d6d30f21ac41a8dc500a2
+RUN curl -fsSL -o /tmp/firefox.tar.xz "$FIREFOX_URL" \
+    && echo "$FIREFOX_SHA256  /tmp/firefox.tar.xz" | sha256sum -c - \
+    && tar -xJf /tmp/firefox.tar.xz -C /opt \
+    && rm /tmp/firefox.tar.xz \
+    && /opt/firefox/firefox --version
+
+# geckodriver v0.36.0, linux64
+ARG GECKODRIVER_URL=https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
+ARG GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
+RUN curl -fsSL -o /tmp/geckodriver.tar.gz "$GECKODRIVER_URL" \
+    && echo "$GECKODRIVER_SHA256  /tmp/geckodriver.tar.gz" | sha256sum -c - \
+    && tar -xzf /tmp/geckodriver.tar.gz -C /usr/local/bin \
+    && rm /tmp/geckodriver.tar.gz \
+    && geckodriver --version
+
+ENV FIREFOX_BIN=/opt/firefox/firefox
+ENV GECKODRIVER=/usr/local/bin/geckodriver
+
+WORKDIR /work
+CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]