Add cross-browser smoke test suite (Layer 1a of #55)

[djscruggs]

Implements Layer 1a from #55 — a cross-browser smoke test suite so the
WebKit regression class (#51) is caught in CI before publish, rather than in
production. Draft while CI is validated and the remaining checklist items
land.

This PR is the new home for discussion of the testing work — see #55 for the
broader monitoring plan.

What this does

• Adds Playwright with chromium / firefox / webkit projects, served over
  http://localhost (a secure context, so _assertSecureContext() passes).
• test/smoke.spec.js asserts loadOnce() resolves and patches
  navigator.credentials.get / .store, plus window.WebCredential.
• Regression guard for loadOnce() throws on iOS (WebKit) since 3.2.1: cannot redefine navigator.credentials #51: one test pins navigator.credentials as a
  non-configurable, non-writable data property — the shape that makes the
  polyfill's Object.defineProperty() throw on Safari/iOS. Verified red on the
  pre-Do not throw when navigator.credentials cannot be redefined #52 code (TypeError: Attempting to change writable attribute of unconfigurable property) and green with the 4.0.2 try/catch fallback, in
  every engine.
• Adds a test CI job (sibling of lint, no needs:).
• README testing section + 4.0.4 changelog entry.

Important finding

Playwright's bundled WebKit (26.5) reports navigator.credentials as
configurable: true — it does not reproduce real Safari/iOS on its own. So
running the plain smoke test under bundled WebKit would give false confidence.
The deterministic guard above (force the property non-configurable) is what
actually exercises the bug, and it runs in all three engines. The cross-browser
smoke test still has value for other breakage (e.g. extension clobbering,
future engine changes).

This means the earlier "bundled WebKit first" decision holds, but with a
caveat: bundled WebKit alone is not a faithful #51 reproduction; the forced
non-configurable test is the real guard.

Local verification

• npm test → 9/9 passing (chromium, firefox, webkit).
• Reverting the 4.0.2 fix and rebuilding → the non-configurable guard fails red
  in every engine with the exact loadOnce() throws on iOS (WebKit) since 3.2.1: cannot redefine navigator.credentials #51 TypeError.
• npm run lint clean.

Checklist / still to do

• Confirm CI green on GitHub runners (esp. playwright install --with-deps
  for webkit on Linux).
• Decide whether to also add a real-extension Chromium job (per
  davidlehn's comment) or rely on the browser-agnostic
  reassignment-after-load simulation already included.
• Mark ready for review once CI is green.

Addresses #55.

[djscruggs]

CI is green ✅

Run: lint 22s, test 51s — 8 passed, 1 skipped.

Getting here surfaced three environment issues worth recording, since they shape what this suite can and can't claim:

1. The slow part was OS dependencies, not the tests. Installing WebKit's media-codec apt packages on a cold GitHub runner repeatedly blew the job timeout (15m, then 25m), even with browser-binary caching — the Ubuntu mirror download was the wall. Fixed by running the job in mcr.microsoft.com/playwright:v1.61.0-noble, which ships all three browsers + OS deps pre-installed. No install step, job back to a 10m timeout, ~50s wall time. (Thanks for the nudge toward the container route — it's a smaller change than the caching workaround and removes the failure entirely.)

2. Firefox needs HOME=/root in the container. The Actions container mounts $HOME at /github/home (owned by pwuser) while the job runs as root; Firefox refuses to launch. Set per Playwright's documented workaround. Also dropped the redundant setup-node step since the image already has Node 22.

3. The #51 guard can't run under WebKit in CI — and bundled WebKit isn't real Safari anyway. This is the substantive finding:

• Playwright's bundled WebKit reports navigator.credentials as configurable: true, so it does not reproduce loadOnce() throws on iOS (WebKit) since 3.2.1: cannot redefine navigator.credentials #51 on its own — the naive smoke test passes even with the 4.0.2 fix reverted.
• The guard forces a non-configurable descriptor to simulate Safari. That's verified red-without-fix / green-with-fix on chromium + firefox. But on Linux WebKit (the CI image) the forced descriptor leaves navigator.credentials.get undefined after load (macOS WebKit doesn't), so the guard is scoped to chromium + firefox. The plain smoke + reassignment tests still run under WebKit.

Net: we now catch the regression class (something redefining navigator.credentials breaks load()) deterministically in CI. We do not catch the literal real-Safari behavior through a real Safari — that would need a macOS runner or a hosted grid (BrowserStack / Microsoft Playwright Testing). I'd suggest tracking that as a follow-up on #55 rather than blocking this PR.

Ready to come out of draft once folks are comfortable with the WebKit scoping decision.