[rmstdope]

Bead: nr-7sn1 (bug, P0). No GitHub issue.

The bug

GitHub moved ubuntu-latest to Ubuntu 26.04. Playwright 1.60.0, the version in our lockfile, refuses that image: playwright install chromium fails with "Playwright does not support chromium on ubuntu26.04-x64". So web-container failed before running any test (PR #3395, twice). web-integration also ran on ubuntu-latest and passed only because its browser came from the cache.

The fix

web-container and web-integration now run on ubuntu-24.04, the image they were last green on. A comment beside each says why, and that moving off it goes together with a Playwright upgrade.

I decided against upgrading Playwright to 1.64.1, which does list ubuntu26.04. It would change the browser every web test runs against and touch the lockfile, and the bead's scope excludes test changes beyond what the runner forces. That upgrade can be its own bead.

Reproduction test

scripts/test_playwright_runner_image.py checks every ci.yml job that runs playwright install:

• each one must be pinned to ubuntu-24.04. Before the fix this failed for both jobs ('ubuntu-latest' != 'ubuntu-24.04').
• the list of such jobs must be exactly these two, so a new one cannot slip past.

Validation

• Python suite: 621 tests OK. ruff check, ruff format and mypy are clean.
• ./scripts/gate-full.sh --fast: passed. The change is non-Rust; build-workload classifies it non-rust.
• This PR's own CI is the real proof: web-container has to go green here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WCDKexBLzRiHm26TufpEph

[rmstdope]

Review (cold read, reviewed_head: 70d5f51d49ca18f15fb09ee955799a66077acf71): reviewed before merge under the producer's review practice, by an agent given the diff and the bead and not the producer's reasoning. A bug bead has no plan, so the diff was read against the bead's bug claim and the reproduction test.

The change matches the bug claim. The pin covers exactly the two jobs that run playwright install. The wasm job uses the runner's own Chrome, which passed on 26.04, so leaving it unpinned is right. The new test passes at this head and would fail on main.

1. Suggestion, not blocking. .github/workflows/ci.yml, web-integration, step "Cache Playwright browsers". The cache key playwright-chromium-${{ hashFiles('pnpm-lock.yaml') }} does not name the runner image. This cache is what hid the bug in web-integration. When the pin later moves to a newer image without a lockfile change, the old Chromium is restored and the install step is skipped. Put the image in the key, and have the test require that the key contains the pinned image.
2. The fix is not yet proven on CI. Confirm that web-container and the rest of CI are green on this PR, then re-run PR docs(nr-z4nw): mockup #3395 as the acceptance asks.

[rmstdope]

Answers to the review: 1. Done in 702a9a2. The cache key now reads playwright-chromium-ubuntu-24.04-…, and test_cached_browsers_are_keyed_by_the_pinned_image requires every Playwright cache key to contain the pinned image, and at least one such key to exist. 2. Waiting on this PR's CI now; PR #3395 gets re-run once it's green. The change is small and self-contained, so it gets no follow-up review.