fix(images): pair chrome + chromedriver via chrome-for-testing

[sjmiller609]

Summary

chromium-headful and chromium-headless previously installed chromium from the rolling ppa:xtradeb/apps PPA while pinning chromedriver to a hardcoded version (146.0.7680.165). Once the PPA upgraded chromium past the pinned chromedriver major, every WebDriver/BiDi e2e test (TestBidiSelenium, TestBidiVibium, TestBidiPuppeteer, TestBidiWebSocket, TestBidiHTTPSession) failed with:

session not created: ChromeDriver only supports Chrome version 146, Current browser version is 148.0.7778.96

This swaps both images over to installing chrome + chromedriver as a matched pair from chrome-for-testing at a single shared CHROME_VERSION ARG. Bumping the version (or any future drift) is now a one-line change that updates both binaries atomically.

Changes

Three commits, all needed to get the existing test suite green on the new binaries:

1. Pair chrome + chromedriver via chrome-for-testing — drop ppa:xtradeb/apps and the apt-installed chromium; download chrome-linux64.zip + chromedriver-linux64.zip from storage.googleapis.com/chrome-for-testing-public/${CHROME_VERSION}/ and install both at /opt/chrome-for-testing/ and /usr/local/bin/chromedriver. Rename the chrome binary to chromium and symlink /usr/bin/chromium so existing callers — and the pgrep/pkill -x chromium calls in chromium-launcher — keep working unchanged. In the headful image, also explicitly install the runtime libs listed in chrome-for-testing's deb.deps that were previously pulled in transitively by apt install chromium.
2. Symlink the chrome-for-testing policy dir to /etc/chromium/policies — Chrome for Testing reads managed policies from /etc/opt/chrome_for_testing/policies/managed, but kernel-images-api and the shared policy.json write to /etc/chromium/policies/managed. Symlink in both images so policy writes flow through unchanged with no Go-side changes. Without this, TestEnterpriseExtensionInstallation fails because forced extensions never reach the browser.
3. Add x11-xserver-utils to the headless image — the apt-installed chromium was transitively pulling in x11-xserver-utils (which provides the xrandr binary). Without it, PATCH /display and every resolution-aware test fails with "failed to get current display resolution" (TestExtensionViewportThenCDPConnection, TestInputEndpointsSmoke, TestScreenshotHeadless, TestDisplayResolutionChange). The headful image already had it explicitly.

Verified

• Locally: downloaded the matched 148.0.7778.97 pair, ran --version on both binaries (matched), chrome --dump-dom https://example.com (renders), chromedriver /status (reports paired version). Renaming the chrome binary to chromium keeps /proc/<pid>/comm as chromium for both the parent and all renderer/zygote children, so pkill -x chromium cleans up cleanly.
• CI: all checks green (build-headful, build-headless, scan, test, Socket Security).

Test plan

• CI builds chromium-headful and chromium-headless
• server-test.yaml test job passes (including the previously-failing TestBidi*, TestEnterpriseExtensionInstallation, and the resolution-aware tests)

---

Note

Medium Risk
Updates both chromium-headful and chromium-headless base images to fetch browser binaries from an external archive and changes runtime library/policy paths, which can break CI/browser automation if versions or deps are wrong.

Overview
Both chromium-headful and chromium-headless images stop installing chromium from the ppa:xtradeb/apps PPA and instead download a matched Chrome + ChromeDriver pair from chrome-for-testing via a single CHROME_VERSION build arg, renaming the browser binary to chromium and symlinking it to /usr/bin/chromium.

To keep existing behavior working, the images add required runtime deps (plus unzip in headless), and symlink Chrome-for-Testing’s managed policy directory (/etc/opt/chrome_for_testing/policies) to the existing /etc/chromium/policies location; headless also explicitly installs x11-xserver-utils for xrandr.

^{Reviewed by Cursor Bugbot for commit 9e0d264. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: This PR modifies Docker images for Chrome/Chromedriver (packages/images/) and does not change kernel API endpoints (packages/api/cmd/api/) or Temporal workflows (packages/api/lib/temporal).

To monitor this PR anyway, reply with @firetiger monitor this.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a2959e0. Configure here.}