feat(claude-code): make agent-browser the default browser tool, via an image-managed skill

Replaces the per-project sandbox-playwright skill with devcontainer-browser,
shipped by the image at /etc/claude-code/.claude/skills/ (Claude Code's
managed skills location). Every project gets it without a copy, and it wins
a name clash with a project skill.

- devcontainer-browser: agent-browser first, for opening the app, UI checks,
  screenshots, DPR/srcset measurement, scripted checks and React render
  profiling. Playwright only for a project's committed @playwright/test
  suite, vitest browser mode or Storybook tests, Firefox/WebKit, or a
  missing agent-browser. Keeps the executablePath wiring matrix and the
  never-download-a-browser rules. Defers agent-browser command docs to the
  version-matched `agent-browser skills get core`.
- managed-settings.json: a claudeMd routing rule loaded in every session,
  and permissions.allow for Bash(agent-browser:*).
- agent-browser moves from the default target into base, so the sandbox
  target has it too; sandbox also sets AGENT_BROWSER_EXECUTABLE_PATH.
- CI verify checks agent-browser, its env var, the managed skill, and both
  new managed-settings keys on both targets.
- devcontainer-upstream-sync 1.3.0: sandbox-playwright is a retired path
  (delete), since a leftover copy would load alongside the new skill.
- README: built-in browser skill section, migration note, and the
  "default target only" notes for agent-browser removed.

Removing the Playwright MCP plugin is separate: #174 (review 2026-11-25).

Author: gatezh

.github/workflows/ci.yml

@@ -117,12 +117,12 @@ jobs:
             add_image "claude-code" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
+              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.allow | index(\"Bash(agent-browser:*)\")' /etc/claude-code/managed-settings.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "default"
             add_image "claude-code-sandbox" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
+              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.allow | index(\"Bash(agent-browser:*)\")' /etc/claude-code/managed-settings.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "sandbox"
           fi
 

claude-code/.claude/skills/devcontainer-upstream-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Use to audit a project's .devcontainer/ and bundled .claude/skills/
 metadata:
   author: Serge Gatezh
   url: https://github.com/gatezh
-  version: "1.2.0"
+  version: "1.3.0"
 ---
 
 # Devcontainer Upstream Sync
@@ -67,12 +67,20 @@ but don't, and includes files that shouldn't be tracked.
 | `.devcontainer/claude-sandbox/docker-compose.yml` | `claude-code/.devcontainer/claude-sandbox/docker-compose.yml` | starter-customize |
 | `.devcontainer/claude-sandbox/init-firewall.sh` | `.devcontainer/claude-sandbox/init-firewall.sh` *(repo root, not `claude-code/`)* | exemplar |
 | `.claude/skills/sandbox-fetch-docs/SKILL.md` | `claude-code/.claude/skills/sandbox-fetch-docs/SKILL.md` | framework-track |
-| `.claude/skills/sandbox-playwright/SKILL.md` | `claude-code/.claude/skills/sandbox-playwright/SKILL.md` | framework-track |
 | `.claude/skills/stacked-prs/SKILL.md` | `claude-code/.claude/skills/stacked-prs/SKILL.md` | framework-track |
 | `.claude/skills/devcontainer-upstream-sync/SKILL.md` | `claude-code/.claude/skills/devcontainer-upstream-sync/SKILL.md` | framework-track |
 | `.claude/settings.json` | `claude-code/.claude/settings.json` | starter-customize |
 | `.mise.toml` | `claude-code/mise.toml` | starter-customize |
 
+### Retired paths
+
+Upstream no longer ships these. If the project still has one, report it as
+`retired: delete` and delete it when adopting — don't diff it.
+
+| local path | why |
+|---|---|
+| `.claude/skills/sandbox-playwright/` | Replaced by `devcontainer-browser`, which the image ships at `/etc/claude-code/.claude/skills/`. The names differ, so a leftover copy loads alongside it and contradicts it (it makes the Playwright MCP the default). |
+
 ### Bucket meanings
 
 - **framework-track** — should match upstream byte-for-byte modulo
@@ -155,7 +163,8 @@ Report format (one row per manifest entry):
 ✓ .devcontainer/devcontainer.json                   framework-track    intentional-customization (Hugo extensions, hostname)
 ⚠ .devcontainer/claude-sandbox/init-firewall.sh     exemplar           template-divergence: see Workflow 2
 ⚠ .mise.toml                                        starter-customize  local-missing (project may not use mise)
-✗ .claude/skills/sandbox-playwright/SKILL.md        framework-track    drift-needs-adopt: 3 hunks
+✗ .claude/skills/stacked-prs/SKILL.md               framework-track    drift-needs-adopt: 3 hunks
+✗ .claude/skills/sandbox-playwright/                retired            retired: delete
 ```
 
 Audit is read-only. Don't apply edits in this phase.