build: run the browser e2e suites in CI (closes #259)

Nothing automatic ran either e2e suite, so every browser-level guarantee in this
wallet -- WebAssembly under the shipped CSP, the recovery-phrase and private-key
DOM wipes, the ConfirmTx spend gate, the dApp approval round trips -- held only
when a human or an agent remembered to run it by hand.

.gitea/workflows/e2e.yml adds two jobs, e2e-chrome and e2e-firefox, one per
browser so a Chrome failure cannot hide the Firefox result. They are separate
from the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
script/cibuild is a docker build whose Dockerfile runs make check, so neither the
cap nor the local fast path is touched. make check is byte-for-byte unchanged.

Neither suite could run on the runner as it stood, and the reason is not
docker-in-docker. The runner executes a job inside a container against the HOST's
docker daemon, and the job's checkout lives on a docker volume rather than a host
path, so `docker run -v "$PWD:/work"` is resolved by the host, silently succeeds
and mounts an empty directory -- measured on this runner. The runner image's node
is also too old to install this repo's dependencies. Both suites therefore ship
the repo to the daemon as a build context and build the extension inside the
pinned image, which leaves docker as the only prerequisite on a runner or a
laptop. The suites themselves are unchanged; only how the repo reaches the
container is.

Both scripts now build with --iidfile and run the image by ID rather than by tag,
so two clones running a suite at once on the same host cannot swap it under each
other.

The jobs report, they do not gate. Whether a check blocks a merge is Gitea branch
protection, which this repo does not configure, so a failure is a red mark a
reviewer must account for. Nothing can pass vacuously: no continue-on-error, no
`|| true`, and both scripts exit non-zero when docker is missing, when the image
build fails and when the browser fails to start.

Wiring this up measured something that has to be said rather than absorbed: the
Chrome suite is flaky under load. Two of six runs of unmutated code on a loaded
machine lost the approval popup out from under the dApp signing wait. It is
filed as #287 and not papered over here -- no retry wrapper, no longer timeout,
no weakened assertion -- and it is the reason e2e-chrome cannot become a
required check yet. README and the workflow say so where a reader meets them.

README.md

@@ -187,14 +187,17 @@ to the background — with the message that would carry it required to be presen
 so that check cannot pass by observing nothing. That last one is the standing
 floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
 
-Two limits of that coverage, neither of them papered over. The RPC is stubbed
+Three limits of that coverage, none of them papered over. The RPC is stubbed
 throughout, so this is **not** a real dApp against a real network with real
 funds; that remains a human pass before 1.0.0. The site-connection prompt is
 raised through `chrome.action.openPopup()`, and headless Chromium's
 browser-action popup is not a page Playwright can see or click, so that one
 prompt is driven at the URL the extension itself puts on the action — the same
 page and the same approval id, but whether a real toolbar click shows it is not
-observable here.
+observable here. And the EIP-1193 error code does not survive the last hop: the
+rejection that crosses the boundary carries code 4001 and is asserted to, but
+`src/content/inpage.js` rebuilds it as `new Error(message)`, so the calling page
+catches an error with no `code` property.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration
@@ -247,13 +250,11 @@ The suite lives in `tests/e2e/firefox/` and has **no npm dependencies at all**:
 it is a small WebDriver client built on global `fetch` and `child_process`
 against geckodriver's HTTP API.
 
-Both suites build their own image, each with the repo and a fresh extension
-build baked in; what differs is the base. The Chrome image layers those on top
-of a published Playwright image, whereas this one is assembled from a `node`
-base, because no published image carries both a pinned Firefox and a matching
-geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external artifacts by
-digest — the `node` base image, the Firefox 153.0.3 tarball, and geckodriver
-0.36.0 — and the Firefox version in particular must not float:
+Unlike the Chrome suite it builds its own container image rather than pulling a
+published one, because no published image carries both a pinned Firefox and a
+matching geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external
+artifacts by digest — the `node` base image, the Firefox 153.0.3 tarball, and
+geckodriver 0.36.0 — and the Firefox version in particular must not float:
 `-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
 Without that flag, both navigating to `moz-extension://` and running
 chrome-context script fail with `unsupported operation`. The flag grants the

TODO.md

@@ -46,15 +46,6 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
-  have. The End-to-End Tests section listed the EIP-1193 code being dropped in
-  the last hop into the page as a standing limit of the dApp coverage; that
-  stopped being true when
-  [#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
-  touch the README. The paragraph is deleted and the two remaining limits — the
-  stubbed RPC and the unobservable toolbar popup — were checked against the
-  current `src/content/inpage.js` and `tests/e2e/` and left as they are
-  ([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
 - 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
   runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
   push, separate from `check`, so `make check` and its 20-second `make test` cap