test(e2e): add playwright e2e harness

Process and API-only Playwright harness: binary and image setup, server/CLI runners, fake Docker Engine socket, read-only database inspection, secret redaction in reports, seeded fuzzing, leak detection and harness self-checks.

e2e/harness/global-setup.ts

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+/**
+ * Run-level setup (runner process): assigns the run id, creates the run scratch directory and
+ * resolves the seed. Values reach the workers through process.env.
+ * Project prerequisites (binary build/validation, image presence) are checked by the
+ * `host-setup` / `image-setup` projects (setup/*.setup.ts).
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { binaryPath, globalSeed, imageRef, RESOURCE_PREFIX } from './env';
+
+export default async function globalSetup(): Promise<void> {
+  const id = crypto.randomBytes(4).toString('hex');
+  const dir = path.join(os.tmpdir(), `${RESOURCE_PREFIX}${id}`);
+  fs.mkdirSync(path.join(dir, 'ws'), { recursive: true, mode: 0o700 });
+  fs.mkdirSync(path.join(dir, 'secrets'), { recursive: true, mode: 0o700 });
+  process.env.DPSAPI_E2E_RUN_ID = id;
+  process.env.DPSAPI_E2E_RUN_DIR = dir;
+  process.env.DPSAPI_E2E_SEED = globalSeed();
+  console.log(
+    `[dpsapi-e2e] run id=${id} seed=${JSON.stringify(globalSeed())} binary=${binaryPath()} image=${imageRef() ?? '(DPSAPI_IMAGE unset)'} scratch=${dir}`,
+  );
+}