feat(test-e2e-playwright): ship @axe-core/playwright in the shared runner

Specs can run WCAG checks through AxeBuilder without a role-local package.
playwright.axe_version pins it with an npm update source, and the shared
install stamp carries both versions so a host with an older stamp reinstalls.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/contributing/actions/testing/playwright.md

@@ -30,7 +30,7 @@ Every Playwright-enabled role MUST provide exactly these two files:
 
 `playwright.config.js` MUST remain centralized in `roles/test-e2e-playwright/files/` and `package.json` in `roles/test-e2e-playwright/templates/package.json.j2` (rendered per-deploy into the staging dir). You MUST NOT duplicate or override either per role.
 
-The `@playwright/test` version pinned into the rendered `package.json` comes from `playwright.version` in `roles/test-e2e-playwright/meta/services.yml` via the `image_version` filter. That YAML value is the single source of truth for the Playwright version.
+The `@playwright/test` version pinned into the rendered `package.json` comes from `playwright.version` in `roles/test-e2e-playwright/meta/services.yml` via the `image_version` filter. That YAML value is the single source of truth for the Playwright version. The rendered `package.json` also installs `@axe-core/playwright` at `playwright.axe_version` from the same file, so a spec MAY run WCAG checks with `const { default: AxeBuilder } = require("@axe-core/playwright");`.
 
 ## CI Image Source 🪞
 

roles/test-e2e-playwright/README.md

@@ -81,7 +81,7 @@ For the file-level contract, use [Contributing `playwright.env.j2`](../../docs/a
 
 This role ships central Playwright defaults:
 
-- `templates/package.json.j2`: `@playwright/test` version derived from `meta/services.yml.playwright.version`
+- `templates/package.json.j2`: `@playwright/test` version derived from `meta/services.yml.playwright.version`, and `@axe-core/playwright` (WCAG checks through `AxeBuilder`) pinned by `meta/services.yml.playwright.axe_version`
 - `files/playwright.config.js`: shared Playwright configuration
 
 Both are used as central defaults for every app role.

roles/test-e2e-playwright/meta/services.yml

@@ -5,3 +5,8 @@ test-e2e-playwright:
 playwright:
   image: mcr.microsoft.com/playwright
   version: "v1.64.1-noble"
+  axe_version: 4.14.0
+  update:
+    - key: axe_version
+      type: npm
+      package: "@axe-core/playwright"

roles/test-e2e-playwright/tasks/01_setup.yml

@@ -60,7 +60,7 @@
       {{
         (not _playwright_shared_stamp_stat.stat.exists)
         or ((_playwright_shared_stamp_content.content | default('') | b64decode | trim)
-            != TEST_E2E_PLAYWRIGHT_VERSION)
+            != TEST_E2E_PLAYWRIGHT_INSTALL_STAMP)
       }}
 
 - name: ⬇️ Pull the Playwright image once for every role of this run
@@ -83,7 +83,7 @@
 - name: 🔧 Provision the shared Playwright install (npm install + stamp)
   when: _playwright_shared_install_needed | bool
   block:
-    - name: 📦 Install @playwright/test into the shared dir (once per host per version)
+    - name: 📦 Install @playwright/test and @axe-core/playwright into the shared dir
       ansible.builtin.command:
         argv:
           - container
@@ -110,5 +110,5 @@
     - name: ✏️ Write shared install stamp
       ansible.builtin.copy:
         dest: "{{ TEST_E2E_PLAYWRIGHT_SHARED_STAMP }}"
-        content: "{{ TEST_E2E_PLAYWRIGHT_VERSION }}"
+        content: "{{ TEST_E2E_PLAYWRIGHT_INSTALL_STAMP }}"
         mode: "0644"

roles/test-e2e-playwright/templates/package.json.j2

@@ -5,6 +5,7 @@
     "test": "playwright test"
   },
   "devDependencies": {
+    "@axe-core/playwright": "{{ TEST_E2E_PLAYWRIGHT_AXE_VERSION }}",
     "@playwright/test": "{{ TEST_E2E_PLAYWRIGHT_VERSION }}"
   }
 }

roles/test-e2e-playwright/vars/main.yml

@@ -2,6 +2,8 @@
 TEST_E2E_PLAYWRIGHT_IMAGE: "{{ lookup('config', 'test-e2e-playwright', 'services.playwright.image') }}:{{ lookup('config', 'test-e2e-playwright', 'services.playwright.version')
   }}"
 TEST_E2E_PLAYWRIGHT_VERSION: "{{ lookup('config', 'test-e2e-playwright', 'services.playwright.version') | image_version }}"
+TEST_E2E_PLAYWRIGHT_AXE_VERSION: "{{ lookup('config', 'test-e2e-playwright', 'services.playwright.axe_version') }}"
+TEST_E2E_PLAYWRIGHT_INSTALL_STAMP: "{{ TEST_E2E_PLAYWRIGHT_VERSION }} axe-{{ TEST_E2E_PLAYWRIGHT_AXE_VERSION }}"
 
 TEST_E2E_PLAYWRIGHT_STAGE_BASE_DIR: "/tmp/test-e2e-playwright"