ci: give every job that runs the unit suite a browser

The hero-geometry check stopped skipping under CI in v1.38 and started failing
instead, which was the point: it had caught its own launch failure and passed
for months, measuring nothing. The install step went into the quality job of
`security.yml` and nowhere else, and a second job runs the same suite — the
auto-merge job for dependency bumps. Every Dependabot pull request has failed
since on `browserType.launch: Executable doesn't exist`, four of them on
2026-09-06 alone (run 34043840314), on an error that says nothing about the
bump. One workflow was fixed; the class was not.

That job installs the same headless shell now, off the same cache key. The
error the check throws names both jobs rather than sending a reader to the
workflow that was already correct, and a guard sweeps the workflow directory so
a third job cannot run the suite with no browser anywhere in it. Its limit is
written down: the sweep is file-scoped, so a workflow with two jobs where only
one installs still satisfies it.

Gates:

  CI=1, browser path hidden      exit=1, "This check is the gate in CI and it
                                 has no browser to measure with"
  CI=1, browser present          exit=0, 4 tests passed (it measures)
  install step deleted from the  guard fails: ["dependabot-auto-merge.yml"]
  auto-merge workflow

src/components/insights/__tests__/health-score-card-geometry.test.tsx

@@ -223,16 +223,23 @@ beforeAll(async () => {
     browser = await chromium.launch();
   } catch (error) {
     const reason = `no Chromium build available (${String(error).slice(0, 200)})`;
-    // In CI the browser is installed by the quality job, so a launch failure
-    // is the job being wrong, not the machine being bare. Throwing from the
-    // hook fails every test in this suite: a geometry check that quietly
-    // skips is the same thing as no geometry check, and this repo shipped
-    // exactly that for months because the skip only ever reached a console
-    // line nobody reads.
+    // In CI the browser is installed by the job that runs the suite, so a
+    // launch failure is the job being wrong, not the machine being bare.
+    // Throwing from the hook fails every test in this suite: a geometry check
+    // that quietly skips is the same thing as no geometry check, and this repo
+    // shipped exactly that for months because the skip only ever reached a
+    // console line nobody reads.
+    //
+    // TWO jobs run `pnpm test`, and naming only one of them here sent a reader
+    // to a workflow that was already correct: the quality job in
+    // `security.yml` and the auto-merge job in `dependabot-auto-merge.yml`.
+    // The second had no install step for three days after this check started
+    // failing instead of skipping, and turned every dependency bump red.
     if (process.env.CI) {
       throw new Error(
         `[hero geometry] ${reason}. This check is the gate in CI and it has no browser to measure with. ` +
-          `Restore the "pnpm exec playwright install --only-shell chromium" step in the quality job of .github/workflows/security.yml.`,
+          `Add the "pnpm exec playwright install --only-shell chromium" step to whichever job ran this suite — ` +
+          `the quality job of .github/workflows/security.yml, or the auto-merge job of .github/workflows/dependabot-auto-merge.yml.`,
       );
     }
     skipReason = reason;