ci: allow manual Pages deploys, sync Dependabot, drop Playwright fuzz job

.github/dependabot.yml

@@ -18,7 +18,7 @@ updates:
     ignore:
       - dependency-name: "@types/node"
         update-types: ["version-update:semver-major"]
-      # Forced in package.json overrides (see CLAUDE.md → package.json overrides).
+      # Forced in package.json overrides (see each repo's CLAUDE.md → package.json overrides).
       # Dependabot PRs would fight the pin / reopen known-accepted risk.
       - dependency-name: "lodash"
       - dependency-name: "three"

.github/workflows/ci.yml

@@ -35,34 +35,3 @@ jobs:
 
   codeql:
     uses: OpenPhysics/Baton/.github/workflows/shared-codeql.yml@main
-
-  # The Playwright fuzz smoke needs a browser, so it runs here rather than in the shared
-  # vitest job. It drives the built sim with the fuzz query parameters and fails on any
-  # console error or assertion.
-  fuzz:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24
-          cache: npm
-
-      - run: npm ci
-
-      - name: Install Chromium for Playwright
-        run: npx playwright install --with-deps chromium
-
-      - name: Fuzz the simulation
-        run: npm run test:fuzz
-        env:
-          FUZZ_DURATION: 30
-
-      - name: Upload fuzz report on failure
-        if: failure()
-        uses: actions/upload-artifact@v7
-        with:
-          name: fuzz-report
-          path: playwright-report/
-          retention-days: 7

.github/workflows/deploy.yml

@@ -3,6 +3,10 @@ name: Deploy
 on:
   push:
     branches: [main]
+  # Manual dispatch, so the site can be published without waiting for a push and
+  # so a deploy that never fired can be recovered by hand. Matches Baton's own
+  # pages.yml, which carries the same pair of triggers.
+  workflow_dispatch:
 
 concurrency:
   group: pages-${{ github.ref }}

CLAUDE.md

@@ -94,8 +94,7 @@ Put unit tests only under root `tests/` (never co-locate or use `__tests__/`). R
 runs the suite when a `test` script is present. Use seeded RNG in engine tests for reproducibility.
 
 View nodes that build a `Dialog` need a `phet.joist.sim` global; call `installSimStub()` from
-`tests/view/simStub.ts` before constructing them. The Playwright fuzz smoke (`npm run test:fuzz`)
-runs as its own CI job, since it needs a browser.
+`tests/view/simStub.ts` before constructing them.
 
 ## Commands