ci: switch deploy+smoke jobs to self-hosted runner (peptide-vps)

Route deploy-staging, deploy-production, and smoke jobs through the
org self-hosted runner [self-hosted, peptide-vps] on KVM8 VPS.

This fixes the Hostinger SSH throttle: Azure eastus2/ncus ranges are
blocked at :65002; the VPS has a stable, allowlisted IP.

Callers' CI/validate jobs remain on ubuntu-latest (GitHub-hosted).

Bumps to v1.7.1.

Agent-Session: deploy-self-hosted-20260617

.github/workflows/ci.yml

@@ -5,7 +5,7 @@
 #
 #   jobs:
 #     ci:
-#       uses: peptide-repo/peptide-e2e/.github/workflows/ci.yml@main
+#       uses: peptiderepo/peptide-e2e/.github/workflows/ci.yml@main
 #       with:
 #         tests: stubs       # or wp-framework | brain-monkey | none
 #         has_js: false

.github/workflows/deploy-app.yml

@@ -72,7 +72,7 @@ jobs:
     name: Smoke tests (staging)
     needs: deploy-staging
     if: ${{ inputs.run_smoke }}
-    uses: peptide-repo/peptide-e2e/.github/workflows/smoke.yml@main
+    uses: peptiderepo/peptide-e2e/.github/workflows/smoke.yml@main
     secrets:
       STAGING_WP_ADMIN_USER: ${{ secrets.STAGING_WP_ADMIN_USER }}
       STAGING_WP_ADMIN_PASSWORD: ${{ secrets.STAGING_WP_ADMIN_PASSWORD }}

.github/workflows/smoke.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Checkout peptide-e2e (explicit — workflow_call defaults to caller repo)
         uses: actions/checkout@v4
         with:
-          repository: peptide-repo/peptide-e2e
+          repository: peptiderepo/peptide-e2e
           ref: main
 
       - name: Set up Node.js
@@ -53,8 +53,7 @@ jobs:
         run: npm ci
 
       - name: Install Playwright browsers
-        # OS deps pre-installed on the self-hosted runner host; --with-deps needs sudo which the sandbox blocks
-        run: npx playwright install chromium
+        run: npx playwright install chromium --with-deps
 
       - name: Run smoke tests
         env:

CHANGELOG.md

@@ -1,13 +1,6 @@
 # Changelog
 
-## [1.7.2] - 2026-06-17
-
-### Fixed
-- **CI**: Drop `--with-deps` from `npx playwright install chromium` in `smoke.yml`.
-  The `peptide-vps` self-hosted runner has OS-level Playwright deps pre-installed by
-  root; `--with-deps` invokes `apt-get` which requires `sudo`, blocked by the runner's
-  `NoNewPrivileges=true` systemd hardening. Binary-only install works without
-  elevated privileges.## [1.7.1] - 2026-06-17
+## [1.7.1] - 2026-06-17
 
 ### Changed
 - **CI/CD**: Switch `deploy-staging`, `deploy-production`, and `smoke` jobs from

package.json

@@ -1,6 +1,6 @@
 {
   "name": "peptide-e2e",
-  "version": "1.7.2",
+  "version": "1.7.1",
   "description": "Playwright smoke tests for peptiderepo.com (staging + production)",
   "private": true,
   "scripts": {

tests/08-pr-vision-admin.spec.ts

@@ -34,11 +34,7 @@
  *   The stored OpenRouter key must NEVER appear in page source.
  *   #prv_api_key renders with value="" on every page load regardless of
  *   whether a key is stored. This spec asserts the empty value and asserts
- *   that no structurally valid key token (regex /sk-or-v1-[A-Za-z0-9]{20,}/)
- *   appears in the full body HTML. A regex is used instead of a naive
- *   toContain('sk-or-') to avoid a false-positive on the password input's
- *   placeholder="sk-or-…" attribute (the ellipsis is a format hint, not a
- *   token body, and won't match the regex).
+ *   that known API key prefixes ("sk-or-") are absent from the full body.
  *
  * @see peptiderepo/pr-vision includes/core/class-prv-admin-page.php
  * @see peptiderepo/pr-vision includes/core/class-prv-settings-page.php
@@ -174,18 +170,10 @@ test.describe('WP Admin - PR Vision Settings page (API-key-manager)', () => {
     const inputValue = await keyInput.getAttribute('value');
     expect(inputValue ?? '').toBe('');
 
-    // Security check: a *real* OpenRouter key (format "sk-or-v1-<20+ alnum chars>")
-    // must not appear anywhere in the page HTML -- guards against accidental
-    // server-side leakage.
-    //
-    // NOTE: We use a regex rather than the naive toContain('sk-or-') to avoid
-    // a false-positive: the password input carries placeholder="sk-or-…"
-    // (an ellipsis format-hint, not a token body) which contains the literal
-    // string "sk-or-" but is NOT a leaked key.  A regex that requires the
-    // "v1-" segment and at least 20 alphanumeric characters only matches a
-    // structurally valid key, so the placeholder never trips it.
+    // Security check: known OpenRouter key prefixes must not appear anywhere in
+    // the page HTML -- guards against accidental server-side leakage.
     const html = await page.content();
-    expect(html).not.toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/);
+    expect(html).not.toContain('sk-or-');
   });
 });