fix(claude-code): make Playwright MCP work in both image variants (#85)

[gatezh]

What

Fixes the Playwright MCP plugin (playwright@claude-plugins-official) so it can launch a browser in both claude-code and claude-code-sandbox images, and survives plugin auto-updates.

Closes #85.

Why

@playwright/mcp defaults to the chrome channel, which hard-codes /opt/google/chrome/chrome — neither variant ships that. The existing ARM64 patch in init-plugins.sh (#64) only ran on aarch64, only at postCreateCommand, and find -print -quit patched only the first cached .mcp.json, so plugin auto-updates between sessions silently broke MCP. Sandbox additionally lacked chromium entirely and couldn't recover at runtime (firewall blocks deb.debian.org).

One factual correction relative to the issue: --browser chromium is not rejected by current @playwright/mcp (v0.0.71) — upstream's own canonical Dockerfile uses cli.js --headless --browser chromium --no-sandbox. The flag is kept in the patched config.

Changes

• Dockerfile: chromium + fonts-freefont-ttf now installed in the sandbox stage too, with the same PLAYWRIGHT_* env vars as default. Updated the stale "kept lean" comment in the default stage.
• patch-playwright-mcp.sh (new): idempotent script that loops every ~/.claude/plugins/cache/*/playwright*/.mcp.json and rewrites the args to --browser chromium --executable-path /usr/bin/chromium --no-sandbox --headless. No-op if /usr/bin/chromium is missing.
• init-plugins.sh: removed the ARM64-only block; delegates to the new patch script (universal across arches).
• devcontainer.json (default): added postStartCommand invoking the patch script.
• claude-sandbox/devcontainer.json: appended the patch to the existing firewall postStartCommand.
• Build workflow: trigger paths now include claude-code/.devcontainer/*.sh (per .claude/rules/workflows.md).
• README: rewrote the Playwright Strategy section, documented the patched .mcp.json shape, updated layout diagram and the "Default-only" callout.

Notes

• The issue proposed a launcher script at /usr/local/bin/playwright-mcp-launcher. Skipped here in favor of inlining the canonical flags directly into the patched .mcp.json — fewer moving parts, and the actual flags are visible to anyone debugging.
• Linters: hadolint (Docker) — same 8 pre-existing version-pinning warnings, no new ones. shellcheck — clean.
• Image still needs to rebuild + a real container session to verify end-to-end (mcp__plugin_playwright_playwright__browser_navigate against about:blank).

Test plan

• CI builds both targets cleanly on amd64 and arm64
• In a claude-code:latest container: install Playwright plugin, confirm cat ~/.claude/plugins/cache/claude-plugins-official/playwright/*/.mcp.json shows the patched args
• In a claude-code-sandbox:latest container: same check; confirm /usr/bin/chromium --version works post-firewall
• In Claude Code: call mcp__plugin_playwright_playwright__browser_navigate to about:blank — succeeds (no "Chromium distribution 'chrome' is not found")
• Plugin-update simulation: drop a dummy unpatched .mcp.json into a fresh cache dir, restart container, confirm postStartCommand re-patched it