fix(tests): repair CI critical-path Playwright failures on main

tests/e2e/public-workbench-hardening.spec.ts

@@ -232,7 +232,10 @@ test("keeps a schema-valid 10-change Terraform plan searchable while bounding re
     .getByLabel("Search all Terraform changes")
     .fill("worker_009");
   await expect(
-    page.getByText("module.boundary.aws_instance.worker_009"),
+    // exact: without it this also matches the row's "Inspect values for
+    // module.boundary.aws_instance.worker_009" <summary>, a strict-mode
+    // violation.
+    page.getByText("module.boundary.aws_instance.worker_009", { exact: true }),
   ).toBeVisible();
   await expect(
     page.getByText("Showing 1–1 of 1 matching changes from 10 total."),
@@ -259,14 +262,14 @@ test("keeps large Kubernetes inventory, nested selector matches, and proposal op
   await page.goto("/workbench/kubernetes");
 
   await expect(
-    page.getByText("Showing 1–8 of 153 resources."),
+    page.getByText("Showing 1–8 of 154 resources."),
   ).toBeVisible();
   await page
     .getByLabel("Search all Kubernetes resources")
     .fill("boundary-worker-149");
   await expect(
     page
-      .getByRole("region", { name: "153 captured offline resources" })
+      .getByRole("region", { name: "154 captured offline resources" })
       .getByText("Deployment demo/boundary-worker-149"),
   ).toBeVisible();
 

tests/e2e/self-hosted-workbench.spec.ts

@@ -1,6 +1,6 @@
 import { expect, test } from "@playwright/test";
 
-test("self-hosted workbench is a separate safe mode when no gateway is configured", async ({
+test("self-hosted workbench shows a disconnected explainer, not a dead interactive shell, when no gateway is configured", async ({
   page,
 }) => {
   const requests: string[] = [];
@@ -18,19 +18,19 @@ test("self-hosted workbench is a separate safe mode when no gateway is configure
   await expect(page.getByRole("navigation", { name: "Product navigation" })).toContainText(
     "Network",
   );
-  await expect(page.getByRole("main", { name: "Authenticated review detail" })).toBeVisible();
-  await expect(page.getByText("Self-hosted review is not configured")).toBeVisible();
-  await expect(page.getByRole("button", { name: "Add to authenticated queue" })).toBeDisabled();
-  await expect(page.getByRole("button", { name: "Refresh" })).toBeDisabled();
-  expect(requests).toEqual([]);
-
-  await page.getByLabel("Example artifact").selectOption(
-    "kubernetes-durable-unsupported",
-  );
+  // No gateway configured: the three-pane authenticated shell (intake form,
+  // review detail, queue) never renders — replaced by an explainer of what
+  // self-hosting adds, so there is no dead interactive control on the page.
   await expect(
-    page.getByText("Unsupported for durable self-hosted review"),
+    page.getByText(
+      "The public deployment at change-safe.vercel.app has none configured, so the queue below is empty by design",
+    ),
   ).toBeVisible();
-  await expect(page.getByRole("button", { name: "Add to authenticated queue" })).toBeDisabled();
+  await expect(page.getByRole("heading", { name: "Beyond public replay" })).toBeVisible();
+  await expect(page.getByRole("heading", { name: "Independent receipt proof" })).toBeVisible();
+  await expect(page.getByText("Fictional claims for illustration only")).toBeVisible();
+  await expect(page.getByLabel("Example artifact")).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Add to authenticated queue" })).toHaveCount(0);
   expect(requests).toEqual([]);
 });