Allow focused child PRs to receive normal CI before the completed suite returns to staging.

* test(e2e): add reusable Playwright foundation

Establish a hermetic full-stack browser harness so settings and future surfaces can exercise real authentication, APIs, and isolated database state safely.

* test(e2e): harden runner lifecycle and artifacts

Fail closed on stale processes, preserve cleanup during interruption, and keep credentials and personal fixture data out of uploaded diagnostics.

* test(e2e): tighten isolation and shutdown guards

Make destructive database operations and service bindings strictly local while ensuring interrupted runs fully stop managed children before cleanup.

* test(e2e): finalize harness safety boundaries

Close the remaining lifecycle, credential-isolation, and CLI escape hatches so future persona and settings suites can build on a fail-closed foundation.

* test(e2e): harden interrupted-run cleanup

Use a detached cleanup supervisor so repeated signals cannot interrupt process-group shutdown or forced removal of the guarded run database.

* test(e2e): guard signal cleanup edge cases

Prevent empty process-group targets and verify forced-drop retries against final database state so interrupted runs cannot self-signal or report false cleanup failures.

* test(e2e): require exact host and race-safe signals

Reject dual-stack host mappings that cannot reach IPv4-only services and tolerate child exit races during process-group signal fallback.

* test(e2e): force IPv4 for hosted test origin

Accept safe dual-stack loopback resolution while pinning Chromium and Node traffic to 127.0.0.1 so CI reaches IPv4-only services reliably.

* test(e2e): settle readiness exit race

Mark successful readiness before the managed process completion branch can reject, preventing later normal shutdown from surfacing an abandoned promise failure.

* test(e2e): propagate IPv4 preference to probes

Keep Node-based Playwright requests on the same IPv4 path as Chromium and use direct loopback for orchestrator probes under dual-stack CI DNS.

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>

* Add safe E2E build reuse and environment isolation

Separate build-time inputs from per-run services so verified artifacts can accelerate local iteration without weakening fresh database or provider boundaries.

* Add validated E2E persona world model

Model settings personas as deterministic, serializable resource graphs and provide production-first factories with exact-ID cleanup so impossible or cross-world fixture states fail before browser tests run.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Seed and verify E2E settings personas

Provision the validated world through real product boundaries, capture isolated sessions through the login UI, and assert persona contracts plus two-worker cross-world isolation without exposing credentials to Playwright.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Harden E2E persona orchestration and remove deferred cleanup

Generate runtime secrets per run, fail closed when diagnostics cannot be scanned, and harden cache and process cleanup while removing the unused exact-ID cleanup module until retained-stack support has a real consumer.

* Fix CI option policy assertions

Make local-only parser scenarios explicit so the safety suite tests the intended policy instead of inheriting the GitHub runner environment.

* Fix organization invitation fixture semantics

Match production organization invitations even when workspace grants are attached, and remove an unused cookie-reset method from the E2E client.

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Harden Playwright lifecycle and persona fidelity

Close production-state and cleanup gaps so the settings E2E platform fails closed without sacrificing useful diagnostics.

* Serialize E2E signal cleanup ownership

Prevent opposite signals and normal finalization from racing detached cleanup or releasing its run lock.

* Preserve browser fixture failures

Report network isolation violations without masking the original Playwright test or fixture error.

* Make E2E signal handoff resilient

Keep cleanup single-flight across repeated signals and retain lock ownership when supervisor logging or startup fails.

* fix(e2e): preserve replacement org coverage

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(e2e): derive usage from entitled coverage

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(e2e): serialize cleanup lock ownership

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(ci): detect safe E2E diagnostics directly

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Add settings navigation acceptance contracts

Co-authored-by: Cursor <cursoragent@cursor.com>

* Support IPv6 loopback in E2E database guard

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Add settings authorization acceptance contracts

Co-authored-by: Cursor <cursoragent@cursor.com>

* Clarify authorization readiness states

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

* test(e2e): cover credential settings workflows

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(e2e): address credential review findings

Co-authored-by: Cursor <cursoragent@cursor.com>

* style(e2e): format credential helper

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(settings): prioritize API key load errors

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

* test(e2e): add enterprise workflow coverage

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(e2e): harden workflow readiness invariants

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Bill Leoutsakos <billleoutsakos@Bills-MacBook-Pro.local>
Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>