fix(runner-e2e): isolate provider cache after browser launch

.github/workflows/runner-full-stack-e2e.yml

@@ -931,7 +931,6 @@ jobs:
           PAPERCLIP_E2E_CAMPAIGN_ID: gha-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.executionId }}
           PAPERCLIP_RUNNER_E2E_SOURCE_SHA: ${{ needs.authorize.outputs.target_sha }}
           PAPERCLIP_RUNNER_E2E_SOURCE_REF: ${{ needs.authorize.outputs.target_ref }}
-          XDG_CACHE_HOME: ${{ runner.temp }}/paperclip-runner-e2e-xdg-cache
         run: pnpm test:e2e:runner -- --id "${{ matrix.executionId }}"
 
       - name: Upload access-controlled packaged cell evidence

tests/runner-e2e/launch.ts

@@ -397,7 +397,6 @@ async function runAttempt(input: {
     const childEnv: NodeJS.ProcessEnv = {
       ...process.env,
       PATH: providerPath,
-      XDG_CACHE_HOME: path.join(temporaryRoot, "xdg-cache"),
       PAPERCLIP_RUNNER_E2E_EXECUTION_IDS: JSON.stringify(
         executions.map((candidate) => candidate.id),
       ),

tests/runner-e2e/server.ts

@@ -32,6 +32,9 @@ const gracefulStopTimeoutMs = 30_000;
 const serverEnvironment = buildPaperclipServerEnvironment(process.env, {
   NODE_ENV: "test",
   PORT: port,
+  // Keep provider caches attempt-private without changing Playwright's browser
+  // cache lookup in the parent process.
+  XDG_CACHE_HOME: path.join(temporaryRoot, "xdg-cache"),
   PAPERCLIP_HOME: paperclipHome,
   PAPERCLIP_CONFIG: configPath,
   PAPERCLIP_INSTANCE_ID: required("PAPERCLIP_INSTANCE_ID"),

tests/runner-e2e/workflow-security.test.ts

@@ -398,9 +398,6 @@ describe("public repository paid workflow security", () => {
         "PAPERCLIP_RUNNER_E2E_SOURCE_REF: ${{ needs.authorize.outputs.target_ref }}",
       );
     }
-    expect(paidJob).toContain(
-      "XDG_CACHE_HOME: ${{ runner.temp }}/paperclip-runner-e2e-xdg-cache",
-    );
     for (const [secret, condition] of Object.entries({
       OPENAI_API_KEY: "matrix.credentialName == 'OPENAI_API_KEY'",
       ANTHROPIC_API_KEY: "matrix.credentialName == 'ANTHROPIC_API_KEY'",