Firefox comes from Mozilla's own apt repo since Ubuntu's is a snap that
does not run in a container. geckodriver is matched to it at build time.
Playwright installs its Chromium and Firefox, skipping WebKit which has
no linux-arm64 build; Playwright's Chromium is exposed as the headless
Chrome.
Model: deepseek-v4-pro
Install valkey-server, valkey-tools and postgresql from apt. Ubuntu
26.04 ships Valkey 9 and PostgreSQL 18, replacing the postgresql16 the
audit pinned.
Model: deepseek-v4-pro
Install libvips-dev, libvips-tools, libheif-dev and
libheif-plugin-aomenc from apt. libvips-tools provides the vips CLI,
which the smoke test uses to confirm libheif is linked as a loader.
Model: deepseek-v4-pro
Install govulncheck with go install after the cleanup step, into
/usr/local/bin so it survives the /root/go removal, and check it in the
smoke test.
Model: deepseek-v4-pro
sneak