deploy: make Playwright e2e a mandatory post-deploy gate

The 2026-09-12 homepage outage slipped through because the live-fleet
Playwright suite was a manual 'MUST invoke' that deploys skipped. Wire it
into deploy.sh as the [3/3] gate: after a behavior-affecting deploy,
run tests/e2e/run.sh against the live fleet; a failure exits DEPLOY
INCOMPLETE. Add --skip-e2e as an emergency escape hatch. Update the
AGENTS.md deployment-completeness contract and flow diagram to match.

Verified: bash -n clean, --skip-e2e parsed, unknown flags rejected,
seam suite green (only the pre-existing comfyui test 73 fails).

AGENTS.md

@@ -148,9 +148,12 @@ only when BOTH of the following pass:
 1. **Unit/config tests** — `./tests/run.sh` (all seams green), and
 2. **Playwright end-to-end tests** — `tests/e2e/run.sh` drives the LIVE fleet
    (homepage, Anubis/Authentik guard chain, guarded vhosts) in a real
-   browser. The E2E suite is deliberately excluded from `./tests/run.sh`
-   because it needs live hosts and credentials, so it MUST be invoked
-   explicitly after every behavior-affecting deploy.
+   browser. As of 2026-09-12 this runs **automatically** as the `[3/3]` gate
+   at the end of `deploy.sh`: a behavior-affecting deploy that fails the e2e
+   suite exits `DEPLOY INCOMPLETE` and must not be treated as good. The suite
+   stays out of `./tests/run.sh` (it needs live hosts plus the `qa-e2e`
+   credentials in `tests/e2e/.env.local`). Bypass only with
+   `deploy.sh --skip-e2e` in an emergency.
 
 ```mermaid
 graph LR
@@ -161,6 +164,10 @@ graph LR
     E --> F[Target pulls with ff-only]
     F --> G[deploy-remote.sh dispatches selected service]
     G --> H[Per-service health check]
+    H --> I[Playwright e2e gate on live fleet]
+    I --> J{e2e green?}
+    J -->|yes| K[Deploy complete]
+    J -->|no| L[DEPLOY INCOMPLETE]
 ```
 
 ## Boot Persistence & Self-Healing (MANDATORY)