[codex] fix browser session isolation defaults

[skulidropek]

Summary

• Make the default Playwright MCP session shared so the main agent can see the existing VNC/browser tabs.
• Keep managed Codex and Claude agents isolated by launching their default commands with MCP_PLAYWRIGHT_ISOLATED=1.
• Harden CI package installs and Docker e2e jobs against cold GitHub runner builds, Ubuntu mirror drift, and long project image builds.
• Switch the host CLI API client to Node HTTP and avoid replaying mutating POST requests after transport failures.
• Update generated project env/template expectations and add coverage for agent isolation and request timeout behavior.

Why

The MCP Playwright wrapper previously defaulted to isolated browser contexts, so the main agent could see only its own blank Playwright tab instead of the already-open VNC/VK browser tab. The new default shares the main browser session while preserving isolation for managed agent launches.

CI was failing on several independent infrastructure edges: Ubuntu apt mirror Hash Sum mismatch, slow/cold Docker project builds, and a Bun/global fetch timeout around long POST /projects calls. The final patches add retry/by-hash apt refreshes, route Ubuntu security/archive sources to the Azure runner-local mirror, disable API server request timeouts for long-running project creation, use Node HTTP in the host CLI, and give Docker e2e jobs enough time to complete cold builds.

Validation

Local checks run:

• sudo docker build -f packages/api/Dockerfile --build-arg DOCKER_GIT_CONTROLLER_REV=ci-fix -t docker-git-api-ci-fix .
• bun run --cwd packages/lib test -- tests/core/templates.test.ts tests/usecases/prepare-files.test.ts tests/usecases/mcp-playwright.test.ts
• bun run --cwd packages/api test -- tests/agents.test.ts
• bun run --cwd packages/lib test -- tests/usecases/prepare-files.test.ts tests/usecases/mcp-playwright.test.ts
• bun run --cwd packages/app test -- tests/docker-git/api-http.test.ts
• bun run --cwd packages/lib typecheck
• bun run --cwd packages/api typecheck
• bun run --cwd packages/app typecheck
• bun run --cwd packages/app lint:effect
• bun run --cwd packages/app build:docker-git
• bun run lint
• bun run --cwd packages/lib lint
• bun run --cwd packages/api lint
• bun run test
• bun run api:test
• bash -n scripts/e2e/clone-auto-open-ssh.sh
• git diff --check

GitHub checks on cd883bb are green, including Docker e2e: Clone auto-open SSH, Clone cache, Login context, Runtime volumes + SSH, and OpenCode.

Notes

Existing generated projects need env/template regeneration and container restart before the new browser-session defaults apply.