ci: install Playwright's headless shell, not the whole of chromium

[lens0021]

Stacked on #470, which is stacked on #469. Review the top commit; the bases merge first.

playwright install chromium fetches three things: Chrome for Testing (379 MiB unpacked), the headless shell (262 MiB) and ffmpeg (5 MiB). These specs run headless and record no video, so the shell is the one Playwright starts and the browser beside it is downloaded to be ignored. Asking for the shell by name skips it. ffmpeg arrives either way, so what this saves is the 379 MiB, about three fifths of the bytes in a 33s step.

Checked, not reasoned

Installed the shell alone into a browser directory of its own, pointed PLAYWRIGHT_BROWSERS_PATH at it so Playwright could find nothing else, and ran the suite against a real bake:

57 passed (14.6s)

--with-deps stays. What it installs is system libraries, which the shell needs as much as the full browser.

If the shell were ever not enough -- a spec asking for a headed browser, or for video -- Playwright fails naming the executable it cannot find, so this cannot quietly test the wrong thing.

Why not cache the browsers, as #461 suggested

zizmor refuses it. actions/cache in a job that also runs docker/build-push-action is its cache-poisoning audit, high severity:

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
 53 |         uses: docker/build-push-action@... runtime artifacts usually published here
246 |       - uses: actions/cache@...           enables caching by default

Tried it first and read that, which is the same objection the comment two lines below this change already records about setup-node's caching. Fetching less needs no exception.

Refs #461.