PlaywrightProvider: self-contain CLAUDE_SANDBOX_NO_PROXY + forward via sudo env wrapper

Two Devin review findings:

1. binprovider_playwright.py imported CLAUDE_SANDBOX_NO_PROXY from
   binprovider_puppeteer.py, violating the "each binprovider owns its
   own provider-specific logic" rule in AGENTS.md. Define the constant
   locally instead.

2. exec() already wraps commands with /usr/bin/env KEY=VAL so that
   PLAYWRIGHT_BROWSERS_PATH survives sudo's env_reset, but the
   NO_PROXY / no_proxy values set by ENV were not being forwarded via
   the same mechanism -- sudo stripped them before reaching playwright,
   defeating the sandbox NO_PROXY fix on Linux (where euid=0 routes
   every subprocess through sudo -n). Forward NO_PROXY/no_proxy as
   CLI-arg assignments alongside PLAYWRIGHT_BROWSERS_PATH.

Author: claude

abxpkg/binprovider_playwright.py

@@ -23,12 +23,16 @@
 from .binary import Binary
 from .binprovider import BinProvider, EnvProvider, log_method_call, remap_kwargs
 from .binprovider_npm import NpmProvider
-from .binprovider_puppeteer import CLAUDE_SANDBOX_NO_PROXY
 from .logging import format_command, format_subprocess_output, get_logger
 from .semver import SemVer
 
 logger = get_logger(__name__)
 
+CLAUDE_SANDBOX_NO_PROXY = (
+    "localhost,127.0.0.1,169.254.169.254,metadata.google.internal,"
+    ".svc.cluster.local,.local"
+)
+
 
 class PlaywrightProvider(BinProvider):
     """Playwright browser installer provider.
@@ -319,6 +323,15 @@ def exec(
             env_assignments.append(
                 f"PLAYWRIGHT_BROWSERS_PATH={cache_dir}",
             )
+        # ``NO_PROXY`` / ``no_proxy`` are set by ``ENV`` to rescue
+        # browser downloads in sandboxes whose egress proxy NO_PROXY
+        # blocks ``cdn.playwright.dev`` / ``storage.googleapis.com``.
+        # They must also survive sudo's ``env_reset``, so forward them
+        # through the ``/usr/bin/env KEY=VAL -- ...`` wrapper below.
+        for proxy_key in ("NO_PROXY", "no_proxy"):
+            proxy_value = env.get(proxy_key)
+            if proxy_value:
+                env_assignments.append(f"{proxy_key}={proxy_value}")
         needs_sudo_env_wrapper = os.geteuid() != 0 and self.EUID != os.geteuid()
         if env_assignments and needs_sudo_env_wrapper:
             resolved_bin = bin_name