test: containerized Chrome end-to-end harness that drives the real popup (closes #181)

Runs the real popup in a pinned containerized Chrome and fails on any uncaught
page error or console.error. Also fixes the two defects it caught: the missing
showView import in addToken.js and the missing addressDotHtml import in
transactionDetail.js.

closes #150
closes #151

TODO.md

@@ -15,7 +15,8 @@ other branch is in flight: the settings About well landed as #145 on 2026-07-26
 and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
 question is resolved. Full policy file set present. `make check` verified
 passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
-#149-#168.
+#149-#168. A real-browser end-to-end suite (`make test-e2e`) now sits alongside
+`make check`, which cannot see a runtime `ReferenceError` in a popup view.
 
 # Next Step
 
@@ -27,6 +28,13 @@ review.
 
 # Completed Steps
 
+- 2026-08-09: Containerized Chrome end-to-end harness (`make test-e2e` /
+  `script/test-e2e`) driving the real popup with all network intercepted, plus
+  the two used-but-not-imported crashes it caught: AddToken unreachable (#150)
+  and TransactionDetail broken for every ERC-20 transfer (#151). Harness
+  demonstrated failing before the fixes and passing after (#181). Interception
+  covers the MV3 background service worker, not just the popup page, and a
+  launch-time canary aborts the suite if worker traffic starts escaping.
 - 2026-08-09: Reviewed the repo end to end and filed the 1.0.0 backlog
   (#149-#168).
 - 2026-07-26: About well in settings with build info, repo link and the version
@@ -52,10 +60,17 @@ review.
 
 # Future Steps
 
-- Fix the two `ReferenceError` crashes that make whole screens unreachable:
-  AddToken (#150) and TransactionDetail for every ERC-20 transfer (#151).
 - Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
   and cannot catch undefined identifiers, which is how #150 and #151 shipped.
+- Decide the libsodium backend that actually ships (#182) and delete the single
+  allowlist entry it owns in `tests/e2e/harness.js`.
+- Extend the end-to-end suite to the dApp approval signing path (EIP-1193
+  through the real content script, background worker and approval popup). That
+  path needs a CDP-based route to background-worker console output first:
+  Playwright exposes no error event for service workers, so an uncaught
+  exception in the worker cannot fail the run today (worker network traffic is
+  already covered). Decide separately whether docker-in-docker makes
+  `make test-e2e` runnable in the Gitea workflow.
 - Make the Firefox target functional: Chrome callback APIs are used against the
   promise-only `browser` namespace (#153).
 - Send and transaction-flow correctness: gas fee excluded from the