Fix Generative UI containment in macOS release CI

[sambitcreate]

Summary

• install Playwright Chromium before the release job runs the Generative UI containment suite
• add a policy test that enforces the install step precedes npm test

Evidence

The first 0.35 release run reached the containment suite but failed all five browser checks because Chromium was not installed. CI already performs this setup; this aligns the release workflow with it.

Verification

• diagnostic policy tests: 7/7
• ESLint
• git diff check

[pullfrog]

no API key found — this repo is configured to use deepseek/deepseek-v4-pro, which needs DEEPSEEK_API_KEY, but the runner has no key for it.

To fix: add the key as a GitHub Actions secret (referenced from your workflow's env: block) or as a Pullfrog secret in the console — or switch this repo to a different model (free models need no key).

Open repo secrets → · Configure model → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using DeepSeek Pro ｜ 𝕏}

[sambitcreate]

Repository-owned CI is green. Pullfrog remains unable to start because this repository config selects deepseek/deepseek-v4-pro without a DEEPSEEK_API_KEY; that external configuration failure does not execute or evaluate this change.