ci: install pinned browser without apt

.gitea/workflows/managed-validation.yml

@@ -29,8 +29,6 @@ jobs:
       # pinned Chromium browser and native runtime libraries.
       image: mcr.microsoft.com/playwright:v1.54.0-noble
       options: --ipc=host
-    env:
-      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Provision the supported Python runtime
@@ -70,8 +68,11 @@ jobs:
               export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
               if [[ "${profile}" == test || "${profile}" == full ]]; then
                 if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
-                  # The version-matched Playwright CI image supplies Chromium
-                  # and its runtime libraries without an apt transaction.
+                  # The image supplies the native browser libraries. Install
+                  # only the lockfile-matched browser payload into an explicit
+                  # job-local path; never invoke Playwright's apt workflow.
+                  export PLAYWRIGHT_BROWSERS_PATH="${RUNNER_TEMP}/managed-playwright"
+                  timeout --foreground 5m "${managed_uv}" run playwright install chromium
                   timeout --foreground 20m "${managed_uv}" run python -m pytest
                 fi
               fi