Fix "Running as root without --no-sandbox is not supported" in CI containers

The problem

Playwright inside a root Docker container (GitHub Actions, most CI images) failed at launch:

Running as root without --no-sandbox is not supported. See https://crbug.com/638180.

and on hardened runners also: Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted.

What didn't work

• Passing --no-sandbox only in Puppeteer config while Playwright's bundled Chromium was launched elsewhere — the flag must reach whichever launcher starts the binary.
• Creating a non-root user but forgetting to chown the browser cache — swaps the sandbox error for Failed to create a directory at /home/agent/.cache/ms-playwright.
• --disable-gpu and friends — irrelevant; the crash is the SUID/namespace sandbox, not graphics.

const { chromium } = require('playwright');
const browser = await chromium.launch({
  args: [
    '--no-sandbox',
    '--disable-setuid-sandbox',
    '--disable-dev-shm-usage', // Docker's default /dev/shm is 64MB; Chromium exhausts it
  ],
});

# Or fix it at the image level: run as a real user instead of root
RUN groupadd -r agent && useradd -r -g agent agent \
 && mkdir -p /home/agent/.cache \
 && chown -R agent:agent /home/agent
USER agent