wip: e2e in ci

tests/e2e/firefox/Dockerfile

@@ -1,10 +1,26 @@
 # Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
-# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
-# harness itself has no dependencies, so nothing is installed for it.
+# with this repo and a freshly built extension inside it, built by
+# script/test-e2e-firefox. The harness itself has no dependencies, so
+# nothing is installed for it.
 #
-# All three external artifacts are pinned by digest. The Firefox version in
-# particular must not float: -remote-allow-system-access is mandatory on 153
-# and was not on 142, so the flag the harness passes is version-coupled.
+# The build context is the repo root. The repo is baked in rather than
+# bind-mounted because a bind mount does not resolve under Gitea Actions:
+# the runner executes the job inside a container against the host's docker
+# socket, so the source side of a -v is resolved by the host daemon, and
+# the job's checkout lives on a docker volume that is not a host path. A
+# build context is streamed to the daemon and therefore works from
+# anywhere. Building the extension here as well means the machine starting
+# the run needs nothing but docker — and it is the only way this suite can
+# have both a built extension and the `--network none` it runs under, since
+# a container with no network cannot install anything.
+#
+# The three external artifacts are all pinned by digest and are fetched in
+# layers that no repo change touches, so editing the harness or any source
+# file re-runs only the two cheap layers at the bottom.
+#
+# The Firefox version in particular must not float:
+# -remote-allow-system-access is mandatory on 153 and was not on 142, so
+# the flag the harness passes is version-coupled.
 
 # node:22-bookworm-slim, 2026-08-12
 FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
@@ -48,4 +64,16 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
 ENV GECKODRIVER=/usr/local/bin/geckodriver
 
 WORKDIR /work
+
+# Same layering as the root Dockerfile: script/bootstrap installs the
+# prerequisites and the dependencies, and the manifests are copied first so
+# that layer is cached until they change.
+COPY script/ script/
+COPY package.json yarn.lock ./
+RUN script/bootstrap
+
+COPY . .
+
+RUN make build
+
 CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]