ci: fail on trusted runs when the admin e2e secret is unavailable

[brtkwr]

Summary

Follow-up to the merged e2e suite (#235). Now that the e2e WIF service account, the secretAccessor grant, the admin secret and the e2e_ci user are provisioned (the E2E_* repo vars are set), the admin-gated specs (admin-config + the minimum-order gate) can run in CI.

This makes the credentialed path fail loud instead of silently skipping:

• On trusted events (same-repo PR / push / dispatch): the auth + secret-resolve steps run with no continue-on-error, and the resolve step exit 1s if the secret can't be read. So a green check means the admin-gated specs actually ran.
• Fork PRs (no OIDC token / no secrets) skip the credentialed steps and run only the credential-free specs, as before.

Why

Previously the credentialed steps were continue-on-error and the specs test.skip without ADMIN_PASS, so the check could be green while the admin-config and min-order specs were quietly skipped, giving false confidence.

Scope

• .github/workflows/playwright.yml only. No test changes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[claude]

Reviewed the workflow change. Logic looks sound: the if guard correctly distinguishes trusted events (same-repo PR / push / dispatch) from fork PRs, continue-on-error is dropped only on the trusted path, and the secret-resolve step now exit 1s instead of silently skipping. No security, data-loss, or breaking-change concerns — this is a CI-only change with no application code or migrations. No critical issues found.

Ready for human approval ✅

[claude]

Re-reviewed after the follow-up commit (locator/screenshot rework in admin-config.spec.ts), in addition to the previously-reviewed playwright.yml change.

• playwright.yml: the trusted-event guard (github.event_name != 'pull_request' || head.repo.full_name == github.repository) correctly gates the credentialed steps, continue-on-error is dropped only on that trusted path, and the secret-resolve step now fails loud (exit 1) instead of silently skipping — matches the stated intent. Dropping 2>/dev/null only surfaces the gcloud error message on failure, not the secret itself.
• admin-config.spec.ts: switches the config_tabs screenshot clip to anchor on section links (two_general/two_version/two_search) instead of the page-nav title, with explicit expect(...).toBeVisible() waits before reading bounding boxes. This is CI/test-only code with no effect on the production module.

No security, data-loss, or breaking-change concerns in either file.

Ready for human approval ✅