Wire E2E smoke + test-runners into CI pipeline

- Re-enable test-runners stage (was disabled since v0.7.2 pending
  Playwright headless fix from shell migration)
- Add e2e-smoke stage: boots server, runs Playwright navigation
  smoke test against every surface, uploads screenshots on failure
- Both stages gate build-and-deploy — failure blocks merge
- Add e2e-smoke service to docker-compose.ci.yml (same Playwright
  image as test-runner, mounts screenshot volume)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.ci.yml

@@ -1,15 +1,18 @@
 # docker-compose.ci.yml — CI test override
 #
-# Extends base docker-compose.yml. Adds a healthcheck to armature and a
-# Playwright test-runner service.  All containers share the default compose
-# bridge network, so the test-runner reaches armature via Docker DNS
-# (http://armature:80).
+# Extends base docker-compose.yml. Adds a healthcheck to armature and
+# Playwright-based test services.  All containers share the default compose
+# bridge network, so services reach armature via Docker DNS (http://armature:80).
 #
-# Usage:
+# Usage (test-runner):
 #   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
 #     --abort-on-container-exit --exit-code-from test-runner
 #
-# The workflow exits with the test-runner's exit code (0 = pass, 1 = fail).
+# Usage (e2e-smoke):
+#   docker compose -f docker-compose.yml -f docker-compose.ci.yml up --build \
+#     --abort-on-container-exit --exit-code-from e2e-smoke
+#
+# The workflow exits with the selected service's exit code (0 = pass, 1 = fail).
 #
 # NOTE: Do NOT use network_mode: host — the workflow container and compose
 # containers are in separate network namespaces inside DinD. Use the default
@@ -42,3 +45,25 @@ services:
       ADMIN_USER: admin
       ADMIN_PASS: admin
     command: ["bash", "-c", "./ci/run-surface-tests.sh"]
+
+  e2e-smoke:
+    build:
+      context: .
+      dockerfile_inline: |
+        FROM mcr.microsoft.com/playwright:v1.52.0-noble
+        WORKDIR /work
+        RUN npm init -y && npm install playwright@1.52.0
+        COPY ci/ /work/ci/
+        RUN chmod +x /work/ci/*.sh
+    depends_on:
+      armature:
+        condition: service_healthy
+    working_dir: /work
+    environment:
+      SERVER_URL: http://armature:80
+      ADMIN_USER: admin
+      ADMIN_PASS: admin
+      SCREENSHOT_DIR: /tmp/e2e-screenshots
+    volumes:
+      - /tmp/e2e-screenshots:/tmp/e2e-screenshots
+    command: ["bash", "-c", "./ci/e2e-smoke-test.sh"]