fix(claude-code): consolidate onto system Chromium to shrink image

[gatezh]

What

Shrinks the daily-rebuilt claude-code devcontainer image by consolidating onto a single system Chromium and eliminating a chown-induced layer duplication.

Why

Per issue #82, the image grew from ~600MB to ~1.07GB. Root cause: two Chromium installs ran side-by-side — Playwright's --only-shell bake (which still pulls Firefox+WebKit despite the flag) and apt chromium pulled transitively by agent-browser install --with-deps. A separate chown -R layer was also rewriting ~452MB of claude-code files into a new layer via overlayfs.

The project's own .claude/rules/dockerfile.md already specifies system Chromium + PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 — the Dockerfile had drifted from that convention.

Changes

• Dockerfile
  • Install chromium + fonts-freefont-ttf via apt in the default target (kept out of base so sandbox stays lean).
  • Set PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 and PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH=/usr/bin/chromium.
  • Remove the Playwright install-deps chromium and install --only-shell RUNs; drop ARG PLAYWRIGHT_VERSION.
  • Run npm install -g @anthropic-ai/claude-code and npm install -g agent-browser as USER node so no follow-up chown -R duplicates files in a new layer.
  • Clean up mise install leftovers (rm -rf /root/.local after copying the binary).
• devcontainer.json (both variants): drop the now-redundant npx playwright install --only-shell chromium from postCreateCommand / updateContentCommand.
• README.md: replace the "Playwright Version Strategy" section with a shorter "Playwright Strategy" note pointing at system Chromium; drop PLAYWRIGHT_VERSION from the Build Args table.

Notes

Breaking change for consumers: projects that use @playwright/test must read process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH in their playwright.config.ts. Playwright does not read this env var automatically — it's a project convention. Projects relying on the old "run playwright install at container creation" step should drop it.

Measured (linux/amd64)

Target	Before	After	Reduction
default	~1.07 GB	660 MB	-38%
sandbox	3.09 GB	350 MB	-89%

Verified

• Hadolint: clean
• Smoke tests pass in both targets: claude, mise, fish, rtk, ralphex, chromium, agent-browser (default); iptables (sandbox)

Closes #82