ci(e2e): run the Chromium shards in the Playwright image too

Installing Chromium's system packages from apt stalled a shard for 29
minutes, the same way WebKit's did. The shards now use the image the
WebKit job already runs in, whose tag follows the lockfile's
playwright-core, so no browser or system package is installed at run
time.

.github/workflows/e2e.yml

@@ -23,9 +23,16 @@ jobs:
   # Two shards grew to 14–19 minutes against the 20-minute cap once the
   # mobile route sweep landed, and a slow runner tipped them over; three
   # shards with a 30-minute cap leave room for both.
+  # Every Playwright job runs inside Microsoft's Playwright image, which ships
+  # the browsers with their system libraries: installing them from apt at run
+  # time stalled shards for 29 minutes twice, once for WebKit and once for
+  # Chromium alone.
   shard:
     runs-on: ubuntu-24.04
+    needs: playwright-version
     timeout-minutes: 30
+    container:
+      image: mcr.microsoft.com/playwright:v${{ needs.playwright-version.outputs.version }}-noble
     strategy:
       fail-fast: false
       matrix:
@@ -38,8 +45,6 @@ jobs:
           POSTGRES_USER: healthlog
           POSTGRES_PASSWORD: healthlog
           POSTGRES_DB: healthlog
-        ports:
-          - 5432:5432
         options: >-
           --health-cmd "pg_isready -U healthlog"
           --health-interval 5s
@@ -47,7 +52,8 @@ jobs:
           --health-retries 10
 
     env:
-      DATABASE_URL: postgresql://healthlog:healthlog@localhost:5432/healthlog?schema=public
+      # Inside a job container the service is reached by its name.
+      DATABASE_URL: postgresql://healthlog:healthlog@postgres:5432/healthlog?schema=public
       ENCRYPTION_KEYS: '{"v1":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'
       ENCRYPTION_ACTIVE_KEY_ID: v1
       API_TOKEN_HMAC_KEY: bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
@@ -56,13 +62,16 @@ jobs:
       AUTH_RP_ORIGIN: http://localhost:3000
       SESSION_COOKIE_SECURE: "false"
       NODE_ENV: production
-      # WebKit runs in the `webkit` job below; installing its ~180 system
-      # packages here once stalled a shard past its 30-minute cap.
+      # The WebKit spec runs in the `webkit` job below.
       E2E_SKIP_WEBKIT: "1"
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      # The image runs as root while the checkout belongs to the runner user;
+      # git refuses such a tree, and the prepare hook calls git.
+      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -76,16 +85,6 @@ jobs:
 
       - run: pnpm db:migrate:deploy
 
-      - name: Cache Playwright browsers
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cache/ms-playwright
-          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
-          restore-keys: |
-            playwright-${{ runner.os }}-
-
-      - run: pnpm exec playwright install --with-deps chromium
-
       # `pnpm build` (not bare `next build`): the prebuild hook generates
       # the versioned service-worker stamp AND the static i18n catalog
       # assets (public/i18n/<locale>.js) the client boots from — without
@@ -146,9 +145,8 @@ jobs:
           if [ -z "$version" ]; then echo "playwright-core not found in pnpm-lock.yaml"; exit 1; fi
           echo "version=$version" >> "$GITHUB_OUTPUT"
 
-  # The WebKit spec (`bottom-sheet.spec.ts`, project `webkit-iphone`) in
-  # Microsoft's Playwright image, which ships WebKit with its system
-  # libraries, so nothing is installed from apt at run time.
+  # The WebKit spec (`bottom-sheet.spec.ts`, project `webkit-iphone`), in the
+  # same image as the shards.
   webkit:
     runs-on: ubuntu-24.04
     needs: playwright-version