test: migrate new e2e test cases to vitest browser mode

Migrate the test cases added on main (after the vite-plus squash-merge)
into the vitest-browser .tsx suites, since the branch replaced the
Playwright .test.ts files:

- colors: add color-picker-from-toolbar and color-picker-from-side-menu
  screenshot tests
- comments: add 'add reactions' test (pierces the emoji-mart shadow DOM
  to click emoji buttons)
- tables: add 'render table cell colors' screenshot test in its own
  advancedtables.test.tsx so it can mount the advanced-tables example
  app via a single render (re-rendering a second app inside a test that
  already rendered one in beforeEach paints blank)

Generate the -linux screenshot baselines in the Playwright container and
drop the unused Playwright-style cursor helpers from editor.ts.

Also harden the workflows: SHA-pin all actions and set least-privilege
permissions (zizmor).

Author: nperez0111

.github/workflows/build.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
 
+permissions:
+  contents: read
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -15,11 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
 
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1
         with:
           node-version-file: ".node-version"
           cache: true
@@ -41,7 +45,7 @@ jobs:
         working-directory: tests
 
       - name: Upload webpack stats artifact (editor)
-        uses: relative-ci/agent-upload-artifact-action@v2
+        uses: relative-ci/agent-upload-artifact-action@a2b5741b4f7e6a989c84ec1a3059696b23c152e5 # v2
         with:
           webpackStatsFile: ./playground/dist/webpack-stats.json
           artifactName: relative-ci-artifacts-editor
@@ -67,11 +71,12 @@ jobs:
       matrix:
         browser: [chromium, firefox, webkit]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
 
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1
         with:
           node-version-file: ".node-version"
           cache: true
@@ -88,15 +93,15 @@ jobs:
         working-directory: tests
 
       - name: Upload blob report (${{ matrix.browser }})
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ !cancelled() }}
         with:
           name: blob-report-${{ matrix.browser }}
           path: tests/blob-report/
           retention-days: 1
 
       - name: Upload failure artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ failure() }}
         with:
           name: e2e-attachments-${{ matrix.browser }}
@@ -118,11 +123,12 @@ jobs:
     container:
       image: mcr.microsoft.com/playwright:v1.51.1-noble
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 100
+          persist-credentials: false
 
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1
         with:
           node-version-file: ".node-version"
           cache: true
@@ -132,7 +138,7 @@ jobs:
 
       # Gather every shard's blob into one directory (blob-report-chromium, …).
       - name: Download blob reports
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: tests/blob-report
           pattern: blob-report-*
@@ -144,7 +150,7 @@ jobs:
         working-directory: tests
 
       - name: Upload merged HTML report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: ${{ !cancelled() }}
         with:
           name: e2e-report
@@ -169,10 +175,12 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Download merged report
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: e2e-report
           path: e2e-report
@@ -181,7 +189,7 @@ jobs:
       # sticky comment with the URL. The companion `pr-preview-cleanup` workflow
       # removes it when the PR closes.
       - name: Deploy report to PR preview
-        uses: rossjrw/pr-preview-action@v1
+        uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1
         with:
           source-dir: e2e-report
           preview-branch: gh-pages

.github/workflows/pr-preview-cleanup.yml

@@ -18,10 +18,12 @@ jobs:
     # Fork PRs never got a preview (read-only token), so nothing to remove.
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Remove PR preview
-        uses: rossjrw/pr-preview-action@v1
+        uses: rossjrw/pr-preview-action@ffa7509e91a3ec8dfc2e5536c4d5c1acdf7a6de9 # v1
         with:
           preview-branch: gh-pages
           umbrella-dir: pr-preview