CI: pyodide-browser gate hard-fails on any Playwright/Pyodide dependabot bump (exact-version wall at scripts/print-pyodide-ci-evidence.mjs:23) #380

Finding

The pyodide-browser gate hard-fails on any Playwright/Pyodide version drift: scripts/print-pyodide-ci-evidence.mjs:23-25 throws 'Pyodide and Playwright must use the reviewed exact versions' unless devDependencies['@playwright/test'] === '1.58.2' and devDependencies.pyodide === '0.28.1' (plus installed==reviewed checks at :26-32). Every dependabot PR that touches Playwright is therefore a guaranteed red gate until someone manually re-reviews the pair.

Evidence from today: dependabot PR #375 (dev-dependencies group, 15 updates) bumps @playwright/test 1.58.2 → 1.65.0 → pyodide-browser job fails with exactly this error (run 42606504856), which cascades into the required gate (lint, test, pyodide-browser, os all red).

Related but distinct from #367 (apache-arrow pin in test/architecture_numeric_oracle.test.ts:104): different file, different gate, different fix shape. Also note #375 additionally introduced 5 no-unnecessary-type-assertion errors under @typescript-eslint 8.72 in src/config/index.ts, src/core/annotation-parser.ts, src/core/callable-compiler.ts — those are fix-on-landing, not a repo issue.

Impact

Every Playwright dependabot PR burns a full CI matrix to fail on a string comparison; combined with #367 and #369 (no pip cache, ~200 MB torch in the required gate) this is the main reason dep PRs pile up (3 open in tywrap).

Proposed fix

Replace the exact-version guard with a reviewed range + lockfile-integrity check (e.g. semver range from package.json + npm ls consistency), or move the reviewed pair to a CI-visible pin file that dependabot co-updates with an auto-generated evidence note, so "reviewed versions" is a documented refresh step rather than a wall.

Effort: S