fix(ci): authenticate protected Tier B previews

[HomenShum]

Summary

• authenticate Tier B Playwright against protected exact-head Vercel previews
• scope bypass headers to the exact preview origin with Chromium CDP Fetch interception
• add an executable two-origin redirect test proving the bypass never follows a cross-origin 302
• disable Vercel Toolbar injection for automation and suppress traces whenever a bypass secret exists
• align canonical Home, honest live Chat/Inbox, and dynamic avatar pulse assertions with current shipped behavior
• make release contracts and redirect-security coverage run in always-on required CI lanes

Security

An independent review reproduced Playwright route.continue({ headers }) propagating a secret across redirect hops. This patch does not use Playwright route/global header APIs. CDP overrides are applied per paused request only when its origin exactly matches the preview origin. A local two-origin test proves origin A receives a dummy header and redirected origin B does not.

Verification

• protected exact-head preview: 12 passed, 1 honest source-chip skip, 0 failed
• required Runtime smoke exact list: 153 passed, 1 existing skip
• always-run Chromium launch/security gate: 37/37 passed
• release workflow contracts: 3/3 passed
• TypeScript: passed
• production build/PWA: passed
• Prettier and git diff --check: passed

No admin bypass; merge remains CI-gated per P0.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
nodebench-ai	Ignored		Jul 14, 2026 11:04am

[github-actions]

PR size advisory

This PR adds 697 lines of substantive change. CONTRIBUTING.md defines a soft limit of ~400 LOC.

If the PR is genuinely cohesive (e.g. an architecture map, a generated migration, a deletion of a dead module), no action is needed. Otherwise consider:

• splitting into 2-3 PRs along independent concerns
• pre-discussing the architecture change in a GitHub Discussion before merge

This is advisory — it does not block the merge.

[github-actions]

✅ Dogfood Visual QA Gate: PASSED

Check	Status
Screenshots	23 captured (pass)
Walkthrough	9 chapters (pass)
Key Frames	9 extracted (pass)
Scribe Steps	8 how-to steps (pass)
Build	success

Artifacts

Download the dogfood-evidence-eb13c97 artifact from the Actions tab for full screenshots, frames, and walkthrough video.

---

Generated by Dogfood QA Gate

[github-actions]

Demo: walkthrough of the surfaces this PR changed is available as a workflow artifact (pr-demo-522) at https://github.com/HomenShum/NodeBenchAI/actions/runs/29327967662