improvement(ci): avoid redundant browser dependency updates

.github/CI.md

@@ -38,6 +38,8 @@ Memory-heavy builds and browser jobs retain appropriately sized Blacksmith runne
 
 WebKit acceptance on Blacksmith uses the matching, digest-pinned Playwright browser image for mobile and docs navigation. The app, database fixtures, native modules, and harness stay on the host and retain loopback URLs. Chromium and GitHub fallback keep native browser installation and launch. Update both workspace Playwright dependencies, the image index digest, and the expected client version/revision checks together; verify the installed release's native launch timeout and real WebKit acceptance before changing the pin.
 
+HTTP and docs browser installation first asks the pinned Playwright driver to simulate its OS dependency installation. When the simulation requires no package changes, the runner avoids an apt update; missing dependencies, proposed upgrades, or an unsuccessful simulation use the normal dependency installer. Browser selection and downloads still use the pinned driver, including full native Chromium for extension acceptance.
+
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 
 Desktop inbox protocol, assistant actions UI, and organization search UI run as three parallel HTTP jobs with isolated databases, apps, and reports. Each harness owns its acceptance task, so an edit selects its own job. The inbox protocol task depends on server and realtime code; the browser tasks also depend on workspace UI. Desktop inbox needs no browser. The UI jobs and browser extension install Chromium while their app starts, waiting for both before executing assertions; browser-install failures still fail the job and preserve the install log. No acceptance assertions are removed by the split.

.github/scripts/http-e2e.sh

@@ -75,7 +75,7 @@ start_browser_install() {
   local name=$1
   shift
   browsers_log="$report_dir/$name-playwright-install.log"
-  setsid --wait bunx --no-install playwright install --with-deps "$@" > "$browsers_log" 2>&1 &
+  setsid --wait bash "$GITHUB_WORKSPACE/.github/scripts/install-playwright.sh" "$@" > "$browsers_log" 2>&1 &
   browsers_pid=$!
 }
 

.github/scripts/install-playwright.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# The dependency dry run uses the pinned driver's package list without updating apt.
+set -euo pipefail
+
+browsers=()
+for argument in "$@"; do
+  case "$argument" in
+    --only-shell|--no-shell) ;;
+    *) browsers+=("$argument") ;;
+  esac
+done
+
+if ! bunx --no-install playwright install-deps --dry-run "${browsers[@]}"; then
+  bunx --no-install playwright install-deps "${browsers[@]}"
+fi
+exec bunx --no-install playwright install "$@"

.github/workflows/docs-negotiation.yml

@@ -20,6 +20,7 @@ on:
       - '.github/actions/setup/**'
       - '.github/scripts/stop-session.sh'
       - '.github/scripts/playwright-server.sh'
+      - '.github/scripts/install-playwright.sh'
   push:
     branches: [staging]
     paths:
@@ -40,6 +41,7 @@ on:
       - '.github/actions/setup/**'
       - '.github/scripts/stop-session.sh'
       - '.github/scripts/playwright-server.sh'
+      - '.github/scripts/install-playwright.sh'
   workflow_dispatch:
     inputs:
       benchmark:
@@ -375,7 +377,7 @@ jobs:
         if: matrix.group == 'chromium' || (matrix.group == 'webkit' && vars.CI_PROVIDER != '' && vars.CI_PROVIDER != 'blacksmith')
         env:
           BROWSER: ${{ matrix.group }}
-        run: bunx --no-install playwright install --with-deps --only-shell "$BROWSER"
+        run: bash .github/scripts/install-playwright.sh --only-shell "$BROWSER"
       - name: Verify production documentation
         id: acceptance
         env: