Fix Pages browser dependency isolation - #10

The approved Pages deployment failed twice because Playwright's dependency installation refreshed an unrelated Google Chrome APT repository whose package index had a checksum mismatch.

Install the pinned Playwright system dependencies using a process-local APT configuration that selects the runner's existing Ubuntu 24.04 source definition, an empty additional-source directory and temporary indexes. Preserve the existing Ubuntu mirrors and signed keyring, all authentication/TLS/hash checks, the pinned Playwright/browser versions and the unchanged full pnpm verify:agentctl gate. No system repository files are edited. Browser download remains a separate unprivileged pinned CLI invocation.

Validation:

• Actual Playwright 1.61.1 installation passed in disposable Ubuntu 24.04 ARM64 while an unsigned extra repository was present. Unscoped APT rejected that repository before and after the successful scoped install; both source files were byte-unchanged and temporary configuration was cleaned.
• Shell syntax, workflow contract, writing, Markdown and diff checks passed.
• Hosted Ubuntu 24.04 AMD64 run 34388941348 passed the unchanged full paired gate in 8m37s: 140 browser checks passed, one unchanged generic mobile-search skip. The actual uploaded artifact 10119181701 has SHA256 1fe9a953062d212d2c6ad029106a6ec7b77471b75191f88c40b0bcca04ef1b43; independent inspection verified all 94 HTML pages, source metadata and all 21 packages. Earlier failed deployment attempts 34384620405/1 and 2 remain recorded in the execution ledger.

The framework pin remains 7dee64e1d1b6fd38c1883d0d235d712590c30fbe; imported docs and all 21 downloadable packages are unchanged. This PR fixes the deployment prerequisite only.

Additional historical archive comparison found one generated CSS difference: the current build retains the existing authored homepage card background/padding rule that the older 2f2 artifact omitted; remaining HTML differences are only the corresponding stylesheet filename. Maintained source and lockfile are identical, and source metadata/all 21 packages remain byte-identical. The failed strict historical comparison and complete difference characterization are retained separately. Public deployment verification will use this exact newly validated artifact.

Deployment completed at merge f53941091e366b27c097cfd14bab2d043c9d130b: Pages run 34390286498 passed full validation (140 browser checks, one unchanged skip) and deployed successfully. Independent public verification confirmed 92 HTML pages, all 21 downloads, metadata and six CSS files match the actual Pages artifact. All 346 nonhidden deployed-artifact files match this reviewed PR build. Source metadata remains exact 7dee64e; all nested manifests/payload hashes pass; visible source boilerplate is absent. Chrome search and the 390px tutorial passed, with the stale role-limit sentence absent. Actual Pages ZIP SHA256: 7ce96b7dd581c69ac496dce179b4aa5063bbc62dc7925659cb82048aa7f2e308. The pinned official Pages uploader omits .nojekyll; the reviewed validation artifact contains it.