wip: e2e in ci

tests/e2e/Dockerfile

@@ -0,0 +1,33 @@
+# Chrome end-to-end image: the pinned Playwright image with this repo and a
+# freshly built extension inside it, built by script/test-e2e. The suite is
+# then started with `docker run`, so every runtime flag the harness needs
+# (--ipc=host in particular) still applies.
+#
+# The repo is baked in rather than bind-mounted because a bind mount does
+# not resolve under Gitea Actions: the runner executes the job inside a
+# container against the host's docker socket, so the source side of a -v is
+# resolved by the host daemon, and the job's checkout lives on a docker
+# volume that is not a host path. A build context is streamed to the daemon
+# and therefore works from anywhere. Building the extension here as well
+# means the machine starting the run needs nothing but docker.
+
+# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
+#
+# The playwright-core devDependency is pinned to the matching Playwright
+# version (1.56.0) and the two must be bumped together: the browsers ship
+# inside this image, and playwright-core looks for the exact browser
+# revision its own version expects. A mismatch fails at launch.
+FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
+
+WORKDIR /work
+
+# Same layering as the root Dockerfile: script/bootstrap installs the
+# prerequisites and the dependencies, and the manifests are copied first so
+# that layer is cached until they change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN make build