Preinstall @playwright/test in browser images at the pinned engine version

[rgarcia]

Problem

Playwright execution code can't use @playwright/test assertions today:

await import("@playwright/test")
// Cannot find package '@playwright/test' imported from /usr/local/lib/playwright-daemon.js

So scripts that use expect(page.locator(...)).toHaveText(...), toBeVisible(), or expect.poll(...) have to vendor their own copy of expect on every run.

There was also no pin on the executor's engine: both Dockerfiles installed the global Playwright packages unversioned (npm install -g typescript playwright-core patchright esbuild), so the daemon's engine moved whenever npm published and the image happened to rebuild, decoupled from server/runtime/package.json. Draft #408 pins that install to the runtime lockfile; this PR supersedes it, because landing it as-is would pin the daemon to the lockfile's 1.62.x while the change below needs 1.64.1.

Change

• Bump patchright and playwright-core in server/runtime/package.json (and the lockfile) from 1.62.x to 1.64.1, so the Browser REPL and the daemon run the same engine.
• In both chromium-headful and chromium-headless Dockerfiles, read the patchright / playwright-core versions from server/runtime/package.json at build time and install the global packages at those pins, plus @playwright/test at the playwright-core pin (@playwright/test releases in lockstep with playwright-core). One source of truth, one place to bump, no drift on rebuild. typescript and esbuild stay unpinned — build tooling, not the browser engine.
• User code in an execute call resolves @playwright/test from the daemon file at /usr/local/lib/playwright-daemon.js, which finds the global install in /usr/local/lib/node_modules — no daemon change needed.
• Add an image e2e in TestPlaywrightExecuteAPI covering the three reported use cases: toHaveText, toBeVisible, and expect.poll.

This is intentionally the explicit import, not an ambient expect global added to the execution scope.

Caveats

• Test-runner-dependent features (snapshot assertions, test() fixtures) still don't make sense inside an execute call. Locator assertions and expect.poll work.
• @playwright/test adds about 5 MB unpacked to the image and doesn't download another browser.
• After this merges and the headful/headless images release, the available import should be documented on the Playwright execution docs page.

Testing

• docker build --check clean on both Dockerfiles.
• Version-extraction snippet verified against the real server/runtime/package.json: resolves patchright@1.64.1, playwright-core@1.64.1, @playwright/test@1.64.1.
• Runtime suite passes against the bumped pins: npm ci + tsc --noEmit + node --test runtime/*.test.ts (43/43).
• go vet ./e2e/ passes. The new e2e block runs in CI, which builds both images and runs make test-e2e; it was not run against a locally built image here.
• Verified outside the image: installed patchright@1.64.1 / playwright-core@1.64.1 / @playwright/test@1.64.1 in the global-install layout, connected Patchright over CDP to Chromium, and ran toHaveText, toBeVisible, and expect.poll against a Patchright page — all pass.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​playwright-core@​1.62.1 ⏵ 1.64.1
	npm/​patchright@​1.62.3 ⏵ 1.64.1			+1	+1

View full report