Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

script/test-browser

@@ -0,0 +1,22 @@
+#!/bin/sh
+# script/test-browser: run the browser test in internal/server. It runs in
+# Docker: Dockerfile.browser builds the test and runs it in a digest-pinned
+# headless browser image, so the host needs no browser.
+#
+# --no-cache because a cached test layer is a test that did not run.
+# --output=type=cacheonly leaves no image behind to clean up.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build \
+        -f Dockerfile.browser \
+        --no-cache \
+        --progress=plain \
+        --output=type=cacheonly \
+        .
+}
+
+main "$@"