feat: assemble driver from npm + nodejs.org instead of deprecated CDN

[mxschmitt]

Summary

The Playwright /builds/driver CDN is being deprecated (#593): Microsoft will stop uploading new driver versions "very soon" and intends to delete existing ones later. playwright-go currently downloads a prebuilt, fixed-layout zip from exactly that CDN at install time, so this would break new releases and eventually all installs.

This PR stops depending on that CDN. Instead, Install() / DownloadDriver() assemble the driver from two durable upstream sources — the same move the official playwright-dotnet (#3322), playwright-python (#3092), and playwright-java (#1936) ports made in June 2026:

• the platform-independent playwright-core package from the npm registry (registry.npmjs.org/playwright-core/-/playwright-core-<ver>.tgz), extracted into <DriverDirectory>/package/ — this contains cli.js; and
• the matching per-platform Node.js binary from nodejs.org/dist, placed at <DriverDirectory>/node[.exe].

The resulting on-disk layout is identical to before, so Run(), Command(), patchDriverBundle(), and the driver-up-to-date check are unchanged. playwright-core ships pre-bundled with zero runtime dependencies, so a plain tarball extract is sufficient — no npm install step is needed.

Why these issues are related

All four issues are facets of one root cause: the driver was obtained as a single welded-together CDN zip with a rigid assumed layout. This PR decouples the two halves (platform-independent JS vs. platform-specific Node.js), which addresses them together:

• Heads-Up: Upcoming deprecation of /builds/driver CDN #593 (CDN deprecation) — primary motivation. npm + nodejs.org replace the deprecated /builds/driver path; both are durable, first-party sources.
• [Bug]: unable to install in arm/v7 arch #584 (arm/v7 fails with exec format error) — the old code silently mapped linux/arm (and any unsupported GOARCH) to the x64 build, producing a confusing runtime exec format error. nodePlatformSuffix() now returns a clear, actionable error for platforms without a prebuilt Node.js binary, telling the user to set PLAYWRIGHT_NODEJS_PATH — which then works, since the Node.js download is skipped when it is set.
• [Feature]: Allow us to set the full path to cli js (driver) #575 / [Feature]: Allow us to set the full path to cli js (driver) #496 (custom driver path on NixOS) — the npm tarball is natively package/-prefixed, matching the existing layout assumption.

New / changed configuration

Env var	Purpose	Default
PLAYWRIGHT_NODEJS_PATH (existing)	Use a preinstalled Node.js; skips the Node.js download. Required on platforms without a prebuilt binary (e.g. 32-bit ARM).	—
PLAYWRIGHT_GO_NPM_REGISTRY (new)	npm registry mirror for playwright-core.	https://registry.npmjs.org
NODE_MIRROR (new)	Node.js distribution mirror (nvm/n convention).	https://nodejs.org/dist

Removed: PLAYWRIGHT_DOWNLOAD_HOST (was specific to the CDN zip path that no longer exists).

Notes on the bundled Node.js version

Pinned to Node.js 24.18.0 (nodeVersion const), matching what upstream Playwright bundles. Note that Node.js 24 dropped the linux-armv7l build, so 32-bit ARM (Raspberry Pi, #584) is handled via the PLAYWRIGHT_NODEJS_PATH escape hatch rather than a zero-config download. (Pinning a Node.js 22 LTS release would restore a prebuilt armv7l binary if a zero-config arm/v7 experience is preferred — noted inline.)

Hardening

Archive extraction is guarded against path traversal (tar/zip slip) via safeJoin, since the registry/mirror hosts are user-configurable and therefore not fully trusted. Download retries no longer hammer non-transient 4xx responses.

Testing

• go build, go vet, gofmt clean.
• Unit tests pass with -race, including the updated TestNpmRegistryEnv and new TestNodePlatformSuffix.
• Verified end-to-end on darwin/arm64: assembled the driver from live npm + nodejs.org and confirmed node package/cli.js --version reports the expected version.

Refs #593, #584, #575, #496