perf(base): trim agent-browser footprint ~960MB→~625MB before release

Size concern ahead of the v1.6.0 base rebuild. agent-browser drives the full
chrome (verified headless: open/title/eval with the headless_shell removed), so
Playwright's chromium_headless_shell-* build is dead weight — drop it (~334MB),
and clean apt/npm caches in-layer. Net browser footprint ~625MB/arch.

CI disk is otherwise fine: build-base's 'Reclaim runner disk' step frees
~20-30GB (hostedtoolcache/dotnet/android/jvm) + docker prune before buildx.
hadolint clean.

CHANGELOG.md

@@ -32,8 +32,9 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   `--with-deps` dependency resolution verified (the t64 renames are handled).
   The global AGENTS.md managed block
   (`rootfs/usr/local/share/pi-devbox/pi-global-AGENTS.append.md`) gains a short
-  pointer so agents discover the capability. Adds ~960 MB (Chromium + headless
+  pointer so agents discover the capability. Adds ~625 MB (Chromium; Playwright's
-  shell). Base-affecting, rebuilds `base-<hash>`.
+  unused headless-shell build is dropped and the apt/npm caches cleaned in-layer
+  to stay lean). Base-affecting, rebuilds `base-<hash>`.
 
 - **`pi-devbox-version` command.** Wraps `/etc/pi-devbox/build-manifest.json`
   into a human-readable summary (release tag, build date, source revision,

Dockerfile.base

@@ -487,8 +487,11 @@ RUN curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors https://deb.nodesour
 # t64 library renames are handled by Playwright's dep list). Build runs as
 # root, so the apt step works. NPM_CONFIG_PREFIX=/usr keeps both CLIs on /usr
 # so they survive the ~/.pi/npm-global volume mount (same trick the variant
-# uses for pi). Cost: ~960 MB (Chromium + headless shell) — the bulk of the
+# uses for pi). After fetching, we DROP Playwright's `chromium_headless_shell-*`
-# base's browser footprint; the one real tradeoff of shipping this everywhere.
+# build — agent-browser drives the full chrome (verified, incl. headless), so the
+# headless shell is dead weight — and clean the apt/npm caches, trimming the
+# layer to ~625 MB (Chromium) from ~960 MB. Still the bulk of the base's size,
+# and the one real tradeoff of shipping this to every variant.
 ARG AGENT_BROWSER_VERSION=latest
 ARG PLAYWRIGHT_VERSION=latest
 ENV PLAYWRIGHT_BROWSERS_PATH=/usr/local/share/ms-playwright
@@ -500,7 +503,10 @@ RUN NPM_CONFIG_PREFIX=/usr npm install -g \
       ln -sf "$chrome" /usr/local/bin/agent-chrome; break; \
     done && \
     agent-browser --version && \
-    test -x "$(readlink -f /usr/local/bin/agent-chrome)"
+    test -x "$(readlink -f /usr/local/bin/agent-chrome)" && \
+    rm -rf "${PLAYWRIGHT_BROWSERS_PATH}"/chromium_headless_shell-* && \
+    npm cache clean --force && \
+    rm -rf /var/lib/apt/lists/* /root/.npm /tmp/*
 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/local/bin/agent-chrome
 
 # ── tldr (tealdeer) — community-maintained command examples ──────────