Wire E2E smoke + test-runners into CI pipeline

- Re-enable test-runners stage (was disabled since v0.7.2 pending
  Playwright headless fix from shell migration)
- Add e2e-smoke stage: boots server, runs Playwright navigation
  smoke test against every surface, uploads screenshots on failure
- Both stages gate build-and-deploy — failure blocks merge
- Add e2e-smoke service to docker-compose.ci.yml (same Playwright
  image as test-runner, mounts screenshot volume)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -380,10 +380,6 @@ jobs:
   # ── Stage 1d: Surface Test Runners ──────────
   # Boots the server in Docker, runs all installed test-runner packages
   # via Playwright, and asserts zero failures.
-  #
-  # DISABLED: Playwright driver can't find the Run All button in headless
-  # mode — likely a shell/SPA rendering issue.  Run manually from the
-  # test-runners surface after deploy until this is resolved.
   # See: docker-compose.ci.yml, ci/surface-test-driver.js
   #
   # Runs when: backend, frontend, or packages changed (runners test all tiers).
@@ -391,8 +387,11 @@ jobs:
   test-runners:
     runs-on: ubuntu-latest
     needs: [detect-changes]
-    if: false  # disabled — see comment above. Condition for v0.7.5:
-    # needs.detect-changes.outputs.backend == 'true' || needs.detect-changes.outputs.frontend == 'true' || needs.detect-changes.outputs.packages == 'true' || needs.detect-changes.outputs.infra == 'true'
+    if: |
+      needs.detect-changes.outputs.backend == 'true' ||
+      needs.detect-changes.outputs.frontend == 'true' ||
+      needs.detect-changes.outputs.packages == 'true' ||
+      needs.detect-changes.outputs.infra == 'true'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -412,6 +411,46 @@ jobs:
         if: always()
         run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
 
+  # ── Stage 1e: E2E Smoke Test ───────────────
+  # Boots the server in Docker, runs Playwright navigation smoke
+  # test against every surface. Asserts topbar, no JS errors.
+  # Screenshots saved as artifacts on failure.
+  # See: docker-compose.ci.yml (e2e-smoke service), ci/e2e-smoke-driver.js
+  e2e-smoke:
+    runs-on: ubuntu-latest
+    needs: [detect-changes]
+    if: |
+      needs.detect-changes.outputs.backend == 'true' ||
+      needs.detect-changes.outputs.frontend == 'true' ||
+      needs.detect-changes.outputs.packages == 'true' ||
+      needs.detect-changes.outputs.infra == 'true'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run E2E smoke tests (compose)
+        env:
+          BUNDLED_PACKAGES: '*'
+          ARMATURE_ADMIN_USERNAME: admin
+          ARMATURE_ADMIN_PASSWORD: admin
+          ARMATURE_ADMIN_EMAIL: admin@test.local
+        run: |
+          docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+            --abort-on-container-exit \
+            --exit-code-from e2e-smoke
+
+      - name: Collect screenshots
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: e2e-screenshots
+          path: /tmp/e2e-screenshots/
+          retention-days: 7
+
+      - name: Teardown
+        if: always()
+        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v
+
   # ── Stage 2: Build, Database, Deploy ─────────
   #
   # Depends on all test jobs. Skipped jobs (due to path gating)
@@ -420,7 +459,7 @@ jobs:
   # Always runs — docs are served in-app by the Docs surface.
   build-and-deploy:
     runs-on: ubuntu-latest
-    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners]
+    needs: [detect-changes, test-go-pg, test-frontend, test-sqlite, test-runners, e2e-smoke]
     # Run unless: a needed job failed or the workflow was cancelled.
     # Skipped test jobs (path-gated) are fine — they don't block.
     # Always deploys — docs are served in-app, VERSION needs a build.