fix(ci): share adopter Playwright in exact runtime

[BenSheridanEdwards]

Why does this feature exist?

StyleProof 4.7.1 isolated its exact npm runtime to preserve an adopter base lockfile, but that runtime brought a second @playwright/test instance. In Fleet’s real cold-base run, the StyleProof runner loaded the isolated instance while the adopter config/spec and CLI loaded Fleet’s locked instance. Playwright rejected the second load, the base capture collapsed, and 223 unchanged surfaces were falsely reported as new.

What changed?

• Keep the exact StyleProof package isolated from the adopter dependency tree.
• Link the isolated runtime’s @playwright/test resolution to the adopter base worktree’s locked package, making the CLI, config, spec, and StyleProof runner share one module instance.
• Extend the cold npm integration regression to fail if the runtime and adopter resolve different Playwright packages while still proving unrelated locked application dependencies do not drift.
• Prepare patch release 4.7.2 and document the fix.

Behavioural Proof (with video and screenshots)

• Video: Not applicable — this is a CLI module-resolution correction with no rendered UI.
• Screenshots: Not applicable — a screenshot cannot prove Node module identity.
• Behaviour tests:

✔ styleproof-ci: exact npm runtime preserves locked dependencies and a valid Playwright baseline
ℹ tests 1
ℹ pass 1
ℹ fail 0

The full browser engine suite also passed: 116 passed.

Verification Summary

• Definition of Done: followed .agents/project/DEFINITION_OF_DONE.md.
• Commands run: npm test; npm run typecheck; npm run lint; npm run format:check; npm run privacy:check; npx playwright install chromium; npm run test:e2e; npm audit --audit-level=high; npm pack --dry-run; git diff --check.
• Results: 631 unit tests passed; 116 browser E2E tests passed; build/typecheck/lint/format/privacy passed; audit found 0 vulnerabilities; 4.7.2 package dry-run succeeded; GitNexus classified the five-file change as low risk with no changed symbols/processes.
• Known risks or skipped checks: The first browser attempt failed because Playwright’s newly selected Chromium build was not installed locally; after installing that exact build, all 116 tests passed. Hosted exact-head CI remains authoritative.

Checklist

• Proof above — linked the regenerated docs/demo/report.md, or pasted the command/test output that demonstrates the change
• If you changed capture/diff/report rendering, ran npm run demo:report and committed docs/demo/ — Not applicable: module resolution changes, rendered report output does not.
• npm run build && npm run typecheck && npm run lint && npm run format:check pass
• npm test passes (and npm run test:e2e if the capture/engine path changed)
• Added/updated tests for the change
• Updated the README / CHANGELOG if behaviour or the public API changed
• If captured output changed, noted that adopters must regenerate baselines — Not applicable: successful capture output is unchanged.
• Followed .agents/project/DEFINITION_OF_DONE.md and .agents/skills/pr-inline-screenshot-proof/SKILL.md
• Screenshots are committed and embedded inline with ![alt](...png?raw=1), or the proof section says Not applicable with the technical reason
• The PR body has no bare screenshot links, local paths, relative paths, or proof placeholders

[github-actions]

🗺️ StyleProof report

📊 View the side-by-side visual report →

---

Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure.