fix(docker): Address remaining PR #745 review comments

- Move Playwright install after node_modules copy to use pinned version
- Use local playwright binary instead of npx to avoid registry fetch
- Add --user automaker -w /app flags to docker exec commands
- Change bold text to proper heading in README (MD036 lint fix)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Dockerfile

@@ -119,13 +119,6 @@ RUN curl -fsSL https://opencode.ai/install | bash && \
     ls -la /home/automaker/.local/bin/ && \
     (which opencode && opencode --version) || echo "opencode installed (may need auth setup)"
 
-# Install Playwright Chromium browser for AI agent verification tests
-# This adds ~300MB to the image but enables automated testing mode out of the box
-# Clean up npx cache after installation to reduce image size
-RUN npx playwright install chromium && \
-    echo "=== Playwright Chromium installed ===" && \
-    ls -la /home/automaker/.cache/ms-playwright/ || echo "Playwright browsers installed" && \
-    rm -rf /home/automaker/.npm/_npx
 USER root
 
 # Add PATH to profile so it's available in all interactive shells (for login shells)
@@ -155,6 +148,15 @@ COPY --from=server-builder /app/apps/server/package*.json ./apps/server/
 # Copy node_modules (includes symlinks to libs)
 COPY --from=server-builder /app/node_modules ./node_modules
 
+# Install Playwright Chromium browser for AI agent verification tests
+# This adds ~300MB to the image but enables automated testing mode out of the box
+# Using the locally installed playwright ensures we use the pinned version from package-lock.json
+USER automaker
+RUN ./node_modules/.bin/playwright install chromium && \
+    echo "=== Playwright Chromium installed ===" && \
+    ls -la /home/automaker/.cache/ms-playwright/ || echo "Playwright browsers installed"
+USER root
+
 # Create data and projects directories
 RUN mkdir -p /data /projects && chown automaker:automaker /data /projects