fix: give the geometry check a browser and stop it skipping in CI

The hero-geometry check has never measured anything in CI. It launches
Chromium in a hook, catches the launch failure, and every case then
returns early — green. The quality job installs no browsers, so every
run of it since the file landed printed

  [hero geometry] SKIPPED — no Chromium build available (Error:
  browserType.launch: Executable doesn't exist at
  /home/runner/.cache/ms-playwright/chromium_headless_shell-1234/ch)

and passed. The file's own header warned about exactly this trap and
then fell into it.

Both ends move. The quality job installs the headless shell before the
unit suite — `--only-shell chromium`, because that is the build
`chromium.launch()` resolves to and the one the failing runs named, with
a cache on the lockfile hash so the download is paid once. And the check
now refuses to be optional: with CI set, a launch failure throws out of
the hook and fails the suite with the step to restore. Without CI it
still skips, through the test context so the skip and its reason land in
the report rather than in a console line nobody reads.

No panel number changed. The measurements the check reads back are the
same ones the reserve was set against: panels of 400 / 428 / 456 / 484
px for three to six rows, 420 px for three rows plus the basis line,
against a 448 px reserve.

.github/workflows/security.yml

@@ -28,6 +28,26 @@ jobs:
 
       - run: pnpm db:generate
 
+      # The hero-geometry check in the unit suite renders the real panel in a
+      # real browser and measures the boxes. Without a browser here it caught
+      # its own launch failure and passed anyway, so from its first day until
+      # v1.38 it measured nothing on any run of this job. The browser is part
+      # of the gate now; the test refuses to skip when CI is set.
+      #
+      # Headless shell only: `chromium.launch()` resolves to
+      # chromium_headless_shell, which is what the failing runs named, and the
+      # full headed build is several times the download for nothing this job
+      # uses. The e2e job keeps `--with-deps chromium` — it drives a real app.
+      - name: Cache Playwright headless shell
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-shell-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            playwright-shell-${{ runner.os }}-
+
+      - run: pnpm exec playwright install --only-shell chromium
+
       # Blocking since v1.15.20 — the settings-split refactor that kept
       # this warn-only is long done and the tree lints clean.
       - name: ESLint