fix(ci): get CI green — CSP, test-hooks wire, e2e helpers, browser tests, sequential Playwright

.github/workflows/ci.yml

@@ -53,6 +53,9 @@ jobs:
           key: clippy-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: clippy-
       - id: clippy
+        # Steps with `id:` end up with `bash -e {0}` (no pipefail) on this runner,
+        # so `... | tee` would silently mask failures. Force pipefail on.
+        shell: bash --noprofile --norc -eo pipefail {0}
         run: cargo clippy --workspace --all-targets -- -D warnings 2>&1 | tee /tmp/clippy.log
       - name: Surface clippy failure
         if: failure() && steps.clippy.conclusion == 'failure'
@@ -85,6 +88,7 @@ jobs:
           key: test-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: test-
       - id: test
+        shell: bash --noprofile --norc -eo pipefail {0}
         run: cargo test --workspace 2>&1 | tee /tmp/test.log
       - name: Surface test failure
         if: failure() && steps.test.conclusion == 'failure'
@@ -145,6 +149,10 @@ jobs:
         with:
           tool: wasm-pack
       - id: browser
+        # `bash -e {0}` (default) does NOT enable pipefail, so `wasm-pack ... | tee`
+        # would silently mask failures (tee always exits 0). Use an explicit shell
+        # invocation that turns pipefail on so the link/test exit code surfaces.
+        shell: bash --noprofile --norc -eo pipefail {0}
         run: wasm-pack test --headless --firefox crates/web 2>&1 | tee /tmp/browser.log
       - name: Surface browser-test failure
         if: failure() && steps.browser.conclusion == 'failure'

.github/workflows/e2e.yml

@@ -42,6 +42,19 @@ jobs:
 
       - name: Run full E2E flow (setup + tests + teardown)
         id: e2e
+        shell: bash --noprofile --norc -eo pipefail {0}
+        # PLAYWRIGHT_WORKERS=1: the multi-peer + cross-browser specs
+        # share a single relay + iroh-gossip mesh, and parallel cold
+        # starts make two peer pairs race on the relay handshake, so
+        # the first 30–50 s of dial timeouts blow past the per-spec
+        # deadline. Sequential execution keeps the warm-relay path
+        # the dominant cost; the full suite settles in ~8–10 min on
+        # a fresh runner. PLAYWRIGHT_RETRIES=0 mirrors local CI runs
+        # and keeps failures actionable instead of papering over them
+        # with flake retries.
+        env:
+          PLAYWRIGHT_WORKERS: '1'
+          PLAYWRIGHT_RETRIES: '0'
         run: just test-e2e-full 2>&1 | tee /tmp/e2e.log
       - name: Surface E2E failure
         if: failure() && steps.e2e.conclusion == 'failure'

.gitignore

@@ -1,5 +1,6 @@
 /target
 dist
+crates/web/index.test.html
 project/.obsidian/
 web/pkg/
 .claude/settings.local.json