test(ci): deterministic deploy gate + advisory quality suite; sync README versions

The deploy gate ran e2e specs that depend on live content and data, so a missing
upload (the /help article images) or a legacy malformed avatar figure could turn
a safe code deploy red. Split the suites by what they actually guarantee:

- Blocking gate (`pnpm test:e2e`, `playwright.config.ts`): only checks the CMS
  can guarantee itself — anonymous redirects, register form fields, the captcha
  DOM contract and the cache-control headers (deterministic origin-direct).
- Advisory suite (`pnpm test:e2e:quality`, `playwright.quality.config.ts`):
  broken images, layout overflow and warm-page latency, which depend on live
  content/upload state and the host. It runs as a `continue-on-error` CI job
  against the public site so a real content problem stays visible without
  blocking the pipeline.

Also add `scripts/sync-readme-versions.mjs` (+ tests, docs and a CI check) so
the pinned versions in README.md can never drift from package.json / .nvmrc.

.gitea/workflows/ci.yaml

@@ -24,6 +24,9 @@ jobs:
       - name: Toolchain check
         run: node scripts/check-node-toolchain.mjs
 
+      - name: README version sync
+        run: node scripts/sync-readme-versions.mjs --check
+
       - name: Deploy port-selection tests
         run: bash scripts/ci-deploy-ports.test.sh
 
@@ -145,6 +148,46 @@ jobs:
           IMAGING_EDGE: "1"
         run: pnpm test:imaging
 
+  # Advisory live-quality checks: broken uploads/theme assets, legacy malformed
+  # avatar figures and warm-page latency. These depend on live content and data
+  # rather than the code under test, so they are informational only —
+  # `continue-on-error` keeps the pipeline green while still surfacing the
+  # signal in the job log and uploaded report. The deterministic caching contract
+  # is enforced by the blocking deploy gate instead.
+  tests-quality:
+    needs: check
+    if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ gitea.repository }}
+          token: ${{ gitea.token }}
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install quality test browser
+        run: pnpm exec playwright install chromium
+
+      - name: Advisory quality checks
+        continue-on-error: true
+        env:
+          PLAYWRIGHT_BASE_URL: https://epicnabbo.nl
+        run: pnpm test:e2e:quality
+
+      - name: Upload quality results
+        if: always()
+        uses: https://gitea.com/actions/gitea-upload-artifact@62ac910c5d3dfa85c7cb2df15afe2e342b2407c2
+        with:
+          name: quality-results
+          path: |
+            playwright-report/quality/
+            test-results/quality/
+          if-no-files-found: warn
+          retention-days: 14
+
   preflight:
     needs: [tests-unit, tests-integration, tests-ui]
     if: gitea.event_name == 'pull_request' || (gitea.event_name == 'push' && startsWith(gitea.ref, 'refs/heads/codex/'))