diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml
index 05072fe..055c2a6 100644
--- a/.gitea/workflows/managed-validation.yml
+++ b/.gitea/workflows/managed-validation.yml
@@ -23,8 +23,18 @@ jobs:
     name: full
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    container:
+      # Gitea's JavaScript actions execute inside the job container, so use
+      # the version-matched Playwright image that includes Node as well as the
+      # pinned Chromium browser and native runtime libraries.
+      image: mcr.microsoft.com/playwright:v1.54.0-noble
+      options: --ipc=host
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Provision the supported Python runtime
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.13.2'
       - name: Validate repository with a bounded profile
         shell: bash
         env:
@@ -54,11 +64,16 @@ jobs:
               "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
               managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
               export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
-              "${managed_uv}" sync --locked
+              "${managed_uv}" sync --locked --extra browser
               export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
               if [[ "${profile}" == test || "${profile}" == full ]]; then
                 if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
-                  "${managed_uv}" run python -m pytest
+                  # The image supplies the native browser libraries. Install
+                  # only the lockfile-matched browser payload into an explicit
+                  # job-local path; never invoke Playwright's apt workflow.
+                  export PLAYWRIGHT_BROWSERS_PATH="${RUNNER_TEMP}/managed-playwright"
+                  timeout --foreground 5m "${managed_uv}" run playwright install chromium
+                  timeout --foreground 20m "${managed_uv}" run python -m pytest
                 fi
               fi
               if [[ "${profile}" == lint || "${profile}" == full ]]; then
diff --git a/docs/REPOSITORY_SANITATION.md b/docs/REPOSITORY_SANITATION.md
new file mode 100644
index 0000000..b15d7fc
--- /dev/null
+++ b/docs/REPOSITORY_SANITATION.md
@@ -0,0 +1,9 @@
+# Repository sanitation status
+
+The accidental deployment log containing live root-SSH/container output was removed from the current tree. Active Unraid examples now use a neutral local hostname and generic appdata/backup paths rather than the operator's private host and storage layout.
+
+## HISTORY_REWRITE_REQUIRED
+
+Earlier commits contain the removed `deploy-log.txt` object, including private deployment commands, host information and runtime/database output. Earlier `.env.unraid.example`, `BACKUP_RESTORE.md` and `DEPLOYMENT.md` revisions also contain the original private host and appdata/backup paths.
+
+Before public review, scan all refs for credentials, SSH targets, personal applicant/job data, production databases, media, backups, logs, archives and large objects. Review fixtures and screenshots for names, contact details, application history and other personal data. No history was rewritten during this campaign.