test: harden coverage and browser release gates

.github/workflows/ci.yml

@@ -66,12 +66,12 @@ jobs:
       - name: Install root dependencies
         run: npm ci
 
-      - name: Install Playwright Chromium
-        run: npx playwright install --with-deps chromium chromium-headless-shell
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium chromium-headless-shell firefox webkit
 
       # The extension specs load dist/chrome, so the artifact has to exist.
       - name: Build the extension
         run: npm run build:extension
 
-      - name: Run extension E2E smoke tests
+      - name: Run cross-browser detection and extension E2E tests
         run: npm run test:e2e

.github/workflows/race-tests.yml

@@ -0,0 +1,51 @@
+name: Repeated Race Tests
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 3 * * *'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: race-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  extension-races:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright Chromium
+        run: npx playwright install --with-deps chromium chromium-headless-shell
+
+      - name: Build the extension
+        run: npm run build:extension
+
+      - name: Repeat race-sensitive extension tests
+        run: npm run test:e2e:race
+
+      - name: Upload failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: race-test-diagnostics
+          path: |
+            test-results/
+            playwright-report/
+          if-no-files-found: ignore
+          retention-days: 14

.github/workflows/release.yml

@@ -175,3 +175,8 @@ jobs:
           prerelease: false
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify published extension release
+        run: node scripts/verify-published-release.mjs "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}