[ahrazzle]

Fix

Extend this existing runner-fix PR rather than opening a duplicate.

• Keep Pages and prerender on explicit Ubuntu 24.04.
• Upgrade Playwright 1.56.1 to 1.64.1 with an integrity-locked npm lockfile and npm ci --ignore-scripts.
• Pin Node 24.22.1 in .node-version and use it in every browser job.
• Check the installed Playwright/core versions and bundled ws version from the actual package's license inventory, not npm's top-level dependency graph.
• Add a non-deploying browser-smoke job to PR CI that installs the pinned Chromium and checks the forum prerender.
• Update contributor installation instructions. Workflow triggers, permissions, concurrency, deployment job and generated content are unchanged.

Why

The original Pages failure was Playwright 1.56.1 on unsupported Ubuntu 26.04. Keeping that old Playwright version also retains bundled ws 8.17.1.

Playwright 1.64.1's installed lib/utilsBundle.js.LICENSE identifies ws 8.21.0, covering GHSA-96hv-2xvq-fx4p / CVE-2026-48779 and GHSA-58qx-3vcg-4xpx / CVE-2026-45736. This is dependency remediation, not a claim that this repository exposed an exploitable WebSocket endpoint.

Node 24.22.1 includes the October 2026 security fixes, including CVE-2026-111497. Exact pins need maintenance when new security updates arrive.

Verification

• Passed on local Node 24.22.1: clean npm ci --ignore-scripts, installed-artifact check (Playwright/core 1.64.1; bundled ws 8.21.0), script syntax, git diff --check.
• Passed: site gate, feed gate, golden cases, regressions, corruption probes and forum tests.
• Passed: parsed YAML comparison verifies unchanged triggers, permissions, concurrency and Pages deploy job.
• Passed: forum prerender using Playwright 1.64.1 against the previously installed Chromium revision 1194. This verifies API compatibility only, not the new Chromium revision.
• Full check with that existing browser: 9 pages unchanged; docs/writing/index.html retains the pre-existing out-of-date content reported on the original PR. No generated output changed.
• Local limitation: Chromium 156.0.8078.4 / revision 1248 download returned invalid/truncated ZIP archives. The new hosted Ubuntu browser-smoke CI must verify the intended browser; do not treat the local fallback test as that pass.
• Hosted Ubuntu CI passed on head 930ca5103a4c5145e93c3238edf05645e92659cd: site run 41726514756, both check and browser-smoke. The browser job successfully verified the pinned tooling, installed the intended Chromium and checked the forum prerender. This resolves the local browser-download verification gap.
• Independent AI review found no blocking source changes. This is not maintainer approval under MERGE-SOP.

No merge, deployment or deployment-workflow rerun performed. Independent current-head maintainer review is required under MERGE-SOP. Merging main triggers existing workflows and needs separate deployment authorization.

Prepared with AI assistance by GPT-Forge (OpenAI) for @ahrazzle under the user's request and routine engineering authorization.