feat(claude-code): make agent-browser the default browser tool, via an image-managed skill

.github/workflows/ci.yml

@@ -117,12 +117,12 @@ jobs:
             add_image "claude-code" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
+              "bun --version || true && claude --version && mise --version && zsh --version && gh --version && gh stack --version && rtk --version && ralphex --version && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "default"
             add_image "claude-code-sandbox" \
               "claude-code/.devcontainer" \
               "claude-code/.devcontainer/Dockerfile" \
-              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
+              "claude --version && mise --version && zsh --version && gh --version && gh stack --version && which iptables && rtk --version && ralphex --version && python3 -c 'import ensurepip' && test -x /usr/local/bin/patch-playwright-mcp && test -r /etc/claude-code/managed-settings.json && jq -r '.hooks.SessionStart[0].hooks[0].command' /etc/claude-code/managed-settings.json | grep -qx /usr/local/bin/patch-playwright-mcp && jq -r '.managedMcpServers.mdn.url' /etc/claude-code/managed-settings.json | grep -qx https://mcp.mdn.mozilla.net/ && agent-browser --version && printenv AGENT_BROWSER_EXECUTABLE_PATH | grep -qx /usr/bin/chromium && test -r /etc/claude-code/.claude/skills/devcontainer-browser/SKILL.md && jq -e '.permissions.deny | index(\"Bash(agent-browser install *)\")' /etc/claude-code/managed-settings.json >/dev/null && printenv AGENT_BROWSER_CONFIG | grep -qx /etc/agent-browser/config.json && jq -e .contentBoundaries /etc/agent-browser/config.json >/dev/null && jq -r '.claudeMd' /etc/claude-code/managed-settings.json | grep -q devcontainer-browser && zsh -ic 'typeset -p ZSH_THEME' | grep -q powerlevel10k/powerlevel10k && stat -c %U /home/node/.local/share | grep -qx node && stat -c %U /home/node/.config/gh | grep -qx node" \
               "sandbox"
           fi
 

claude-code/.claude/skills/devcontainer-upstream-sync/SKILL.md

@@ -4,7 +4,7 @@ description: Use to audit a project's .devcontainer/ and bundled .claude/skills/
 metadata:
   author: Serge Gatezh
   url: https://github.com/gatezh
-  version: "1.2.0"
+  version: "1.3.0"
 ---
 
 # Devcontainer Upstream Sync
@@ -67,12 +67,20 @@ but don't, and includes files that shouldn't be tracked.
 | `.devcontainer/claude-sandbox/docker-compose.yml` | `claude-code/.devcontainer/claude-sandbox/docker-compose.yml` | starter-customize |
 | `.devcontainer/claude-sandbox/init-firewall.sh` | `.devcontainer/claude-sandbox/init-firewall.sh` *(repo root, not `claude-code/`)* | exemplar |
 | `.claude/skills/sandbox-fetch-docs/SKILL.md` | `claude-code/.claude/skills/sandbox-fetch-docs/SKILL.md` | framework-track |
-| `.claude/skills/sandbox-playwright/SKILL.md` | `claude-code/.claude/skills/sandbox-playwright/SKILL.md` | framework-track |
 | `.claude/skills/stacked-prs/SKILL.md` | `claude-code/.claude/skills/stacked-prs/SKILL.md` | framework-track |
 | `.claude/skills/devcontainer-upstream-sync/SKILL.md` | `claude-code/.claude/skills/devcontainer-upstream-sync/SKILL.md` | framework-track |
 | `.claude/settings.json` | `claude-code/.claude/settings.json` | starter-customize |
 | `.mise.toml` | `claude-code/mise.toml` | starter-customize |
 
+### Retired paths
+
+Upstream no longer ships these. If the project still has one, report it as
+`retired: delete` and delete it in Workflow 2 — don't diff it.
+
+| local path | why |
+|---|---|
+| `.claude/skills/sandbox-playwright/` | Replaced by `devcontainer-browser`, which the image ships at `/etc/claude-code/.claude/skills/`. The names differ, so a leftover copy loads alongside it and contradicts it (it makes the Playwright MCP the default). |
+
 ### Bucket meanings
 
 - **framework-track** — should match upstream byte-for-byte modulo
@@ -155,7 +163,8 @@ Report format (one row per manifest entry):
 ✓ .devcontainer/devcontainer.json                   framework-track    intentional-customization (Hugo extensions, hostname)
 ⚠ .devcontainer/claude-sandbox/init-firewall.sh     exemplar           template-divergence: see Workflow 2
 ⚠ .mise.toml                                        starter-customize  local-missing (project may not use mise)
-✗ .claude/skills/sandbox-playwright/SKILL.md        framework-track    drift-needs-adopt: 3 hunks
+✗ .claude/skills/stacked-prs/SKILL.md               framework-track    drift-needs-adopt: 3 hunks
+✗ .claude/skills/sandbox-playwright/                retired            retired: delete
 ```
 
 Audit is read-only. Don't apply edits in this phase.
@@ -179,6 +188,11 @@ Driven by Workflow 1's report. For each row that needs action:
 3. Apply only the hunks they accept.
 4. Stage; don't commit.
 
+### `retired: delete`
+
+1. Show the path and its "why" from §"Retired paths".
+2. Confirm with the user, then `git rm -r <local-path>`. Don't commit.
+
 ### Special cases
 
 - **`init-firewall.sh` (exemplar):** the canonical upstream copy is at