feat(runner): read the share viewer from the outside (DEV-2203)

[danielzytohoc]

Second in the DEV-2203 series. Stacked on #181 — GitHub retargets to master when that merges.

What

e2e/share-view.spec.ts — six read-only checks of the deployed /d + /embed contract, against a permanent fixture demo (r-react-18-0-0, the IT-540 launch share; AGENTS.md now documents the replacement procedure):

• the built demo renders for an anonymous viewer (tagged @smoke — zero containers, zero writes, post-deploy-cheap)
• slashless /d/:id → 308, not a second served copy
• /d frame-locked to itself (frame-ancestors 'self' + X-Frame-Options), HTML must-revalidate
• /embed docs-only: allowlist frame-ancestors, no X-Frame-Options, no CORS
• __source.json never served
• unknown id is a real 404

Nothing here existed: authed-actions.spec.ts proves the share UI with /api/demos stubbed and never leaves the SPA.

Gate: test.skip(!E2E_BASE_URL) — vite preview has no /api, /d or /embed routes.

Verification

Against prod: 6 passed in 1.4 s. Without E2E_BASE_URL: 6 skipped.

The authed write path (create → build → view → revoke) lands separately as share-create-live.spec.ts.

---

Note

Low Risk
Test-only and documentation changes with no production code paths modified; specs are read-only and skip without E2E_BASE_URL.

Overview
Adds read-only Playwright coverage for the deployed share viewer (/d/:id and /embed/:id) that app-side specs never hit because they stub APIs and stay in the SPA.

e2e/share-view.spec.ts — six checks against a permanent fixture demo (r-react-18-0-0), skipped unless E2E_BASE_URL points at a deployment with /api, /d, and /embed: anonymous Handsontable render on /d (tagged @smoke), 308 redirect for slashless URLs, /d frame-lock and HTML revalidation headers, /embed docs-only framing (allowlisted frame-ancestors, no X-Frame-Options, no CORS), __source.json returns 404, and unknown ids return real 404s.

AGENTS.md — documents that backend-bound specs self-gate on E2E_BASE_URL and that share-view.spec.ts depends on the fixture id not being revoked, with a replacement procedure.

^{Reviewed by Cursor Bugbot for commit c262d96. Bugbot is set up for automated code reviews on this repo. Configure here.}

[qunabu]

Task linked: IT-540 Self-hosted live demo runner (replace CodeSandbox + render-ms)

[danielzytohoc]

Collapsed into #184 (Dan's call: spec-only PRs reviewed as one unit — #184 now bases on master and carries this PR's commits; nothing was dropped). The branch stays for history.