ci(studio): cache the pinned Chrome and retry its download so one blip does not fail a shard

.github/actions/ensure-browser/action.yml

@@ -0,0 +1,21 @@
+name: Ensure the pinned headless shell
+description: >-
+  Restores the pinned Chrome from the actions cache (keyed on the file that pins it), then runs `browser ensure`,
+  retrying a download that fails so one network blip does not fail the shard. Needs the built CLI at
+  packages/cli/dist.
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        path: ~/.cache/hyperframes/chrome
+        key: hf-chrome-${{ runner.os }}-${{ hashFiles('packages/engine/src/services/chromeHostCeiling.ts') }}
+    - shell: bash
+      run: |
+        for attempt in 1 2 3; do
+          node packages/cli/dist/cli.js browser ensure && exit 0
+          echo "::warning::browser ensure failed (attempt $attempt of 3)"
+          sleep $((attempt * 10))
+        done
+        exit 1

.github/workflows/ci.yml

@@ -1206,7 +1206,7 @@ jobs:
           name: edit-accuracy-cli
           path: packages/cli/dist
       # Studio and the producer both run in the engine's pinned headless shell.
-      - run: node packages/cli/dist/cli.js browser ensure
+      - uses: ./.github/actions/ensure-browser
       - name: Read the base branch's edit accuracy baseline
         run: |
           bash scripts/ci/base-file.sh packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/base-edit-accuracy.json
@@ -1276,7 +1276,7 @@ jobs:
         with:
           name: edit-accuracy-cli
           path: packages/cli/dist
-      - run: node packages/cli/dist/cli.js browser ensure
+      - uses: ./.github/actions/ensure-browser
       - name: Read the base branch's edit accuracy baseline
         run: |
           bash scripts/ci/base-file.sh packages/studio/tests/e2e/edit-accuracy/baseline.json /tmp/base-edit-accuracy.json

.github/workflows/studio-drag-frames.yml

@@ -51,7 +51,7 @@ jobs:
       - uses: ./.github/actions/prepare-ffmpeg-bin
       - run: bash scripts/ci/install-workspace-dependencies.sh
       - run: bun run build
-      - run: node packages/cli/dist/cli.js browser ensure
+      - uses: ./.github/actions/ensure-browser
       - name: Run the drag cases
         working-directory: packages/studio
         run: |