test(ci): deterministic deploy gate + advisory quality suite; sync README versions

The deploy gate ran e2e specs that depend on live content and data, so a missing
upload (the /help article images) or a legacy malformed avatar figure could turn
a safe code deploy red. Split the suites by what they actually guarantee:

- Blocking gate (`pnpm test:e2e`, `playwright.config.ts`): only checks the CMS
  can guarantee itself — anonymous redirects, register form fields, the captcha
  DOM contract and the cache-control headers (deterministic origin-direct).
- Advisory suite (`pnpm test:e2e:quality`, `playwright.quality.config.ts`):
  broken images, layout overflow and warm-page latency, which depend on live
  content/upload state and the host. It runs as a `continue-on-error` CI job
  against the public site so a real content problem stays visible without
  blocking the pipeline.

Also add `scripts/sync-readme-versions.mjs` (+ tests, docs and a CI check) so
the pinned versions in README.md can never drift from package.json / .nvmrc.

README.md

@@ -1065,6 +1065,7 @@ fewer than 1 GB would remain, the script refuses to start.
 | `pnpm test:coverage`  | 8 GB    | Vitest with coverage                    |
 | `pnpm test:ui`        | 8 GB    | Playwright                              |
 | `pnpm test:e2e`       | 8 GB    | Playwright                              |
+| `pnpm test:e2e:quality` | 8 GB  | Playwright (advisory)                   |
 | `pnpm test:integration` | 8 GB  | Vitest integration config               |
 | `pnpm typecheck`      | 6 GB    | `tsc --noEmit`                          |
 
@@ -1132,7 +1133,8 @@ the headroom left for everything else on the machine; the effective ceiling is
 | `pnpm test:coverage`      | Run all tests with coverage thresholds enforced    |
 | `pnpm test:ui`            | Playwright UI tests (`playwright.ui.config.ts`)    |
 | `pnpm test:ui:update`     | Playwright UI tests, updating snapshots            |
-| `pnpm test:e2e`           | Playwright end-to-end tests                        |
+| `pnpm test:e2e`           | Playwright end-to-end tests (blocking deploy gate) |
+| `pnpm test:e2e:quality`   | Advisory content/latency checks (non-blocking)     |
 | `pnpm test:integration`   | Integration tests (own Vitest config)              |
 | `pnpm test:housekeeping`  | Housekeeping feature tests                         |
 | `pnpm lint`               | Lint and format check (Biome)                      |
@@ -1295,6 +1297,25 @@ pnpm analyze      # Build and report per-route bundle sizes
 pnpm biome:check  # Lint and format
 ```
 
+### End-to-end tests
+
+`pnpm test:e2e` is the **blocking deploy gate**. It only contains checks the CMS
+can guarantee on its own (anonymous redirects, the register form fields and the
+captcha DOM contract, cache-control headers), so a green run means a code deploy
+is safe.
+
+Checks that depend on **live content or data** — a missing upload or theme asset
+(`/help` article images), a legacy malformed avatar figure, warm-page latency —
+live in a separate advisory suite:
+
+```bash
+pnpm test:e2e:quality   # playwright.quality.config.ts, never blocks a deploy
+```
+
+It is run against the public site as a `continue-on-error` CI job, so it still
+surfaces a real content problem without turning the pipeline red. Point either
+suite at any running CMS with `PLAYWRIGHT_BASE_URL`.
+
 ### Contributing
 
 1. Ensure typecheck and tests pass: `pnpm typecheck && pnpm test`