wip: e2e in ci

script/test-e2e-firefox

@@ -5,7 +5,9 @@
 #
 # Deliberately NOT called by script/check or script/test, for the same
 # reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
-# and a browser suite does not fit.
+# and a browser suite does not fit. The e2e workflow in
+# .gitea/workflows/e2e.yml runs it on every push, as a job separate from
+# check so the 20-second cap stays intact.
 #
 # Unlike script/test-e2e this builds its image locally, because no
 # published image carries both a pinned Firefox and a matching geckodriver.
@@ -49,13 +51,17 @@ main() {
     # No --privileged. Firefox's sandbox logs
     # "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
     # it is cosmetic and headless Firefox runs fine without it.
-    docker run --rm \
+    #
+    # script/e2e-container is `docker run` with the repo placed at /work;
+    # it copies rather than mounts, because a bind mount does not resolve
+    # under Gitea Actions. See the comment at the top of that script. The
+    # copy happens before the container starts, so --network none still
+    # covers everything the suite does.
+    "$SCRIPT_DIR/e2e-container" \
         --shm-size=1g \
         --network none \
         --user "$(id -u):$(id -g)" \
         -e HOME=/tmp \
-        -v "$ROOT:/work" \
-        -w /work \
         "$IMAGE" \
         node tests/e2e/firefox/run.js dist/firefox
 }