chore(deps): requirements-dev.txt pinning Playwright + jsonschema (#95 / #94)

Pins the two third-party Python packages that the repo's dev tooling
imports, so a fresh clone is reproducible without ambient pip state:

  - playwright>=1.54,<2.0 — tools/capture-gallery-hero.py (#67 / #94 hero PNG)
  - jsonschema>=4.0,<5.0  — verify-plugin.sh, verify-security.sh,
                            verify-seed-expectations.sh, mock-bootstrap.sh,
                            generate-spec-anchor-audit.py

Preview Forge is not a Python package, so no pyproject.toml — a plain
requirements-dev.txt matches the script-driven nature of the Python side.
The capture-gallery-hero.py docstring now references the new install
contract.

Verified:
  - python3 -m pip install -r requirements-dev.txt (fresh venv) — succeeds
  - bash scripts/verify-plugin.sh — Pass: 57 / Fail: 0
  - bash tests/fixtures/security/verify-security.sh — all defenses holding
  - bash tests/e2e/mock-bootstrap.sh {standard,pro,max} — PASS x3

Author: sgwannabe

requirements-dev.txt

@@ -0,0 +1,30 @@
+# Dev-only Python dependencies for Preview Forge tooling.
+#
+# Install:
+#   python3 -m pip install -r requirements-dev.txt
+#
+# Browser binaries for Playwright (one-off, after the pip install above):
+#   python3 -m playwright install --with-deps firefox chromium
+#
+# Preview Forge is NOT a Python package (no installable source / __init__.py).
+# These pins exist so the handful of Python *scripts* and *tools* that the
+# repo ships are reproducible without ambient pip state. JS-side tooling
+# stays in package.json / pnpm-workspace.yaml.
+
+# ---------------------------------------------------------------------------
+# Hero screenshot helper
+#   tools/capture-gallery-hero.py — regenerates docs/assets/v1.6-gallery-hero.png
+#   (the README/SUBMISSION above-the-fold gallery hero, #67 / #94).
+# ---------------------------------------------------------------------------
+playwright>=1.54,<2.0
+
+# ---------------------------------------------------------------------------
+# JSON Schema validation (used by several verify-* shell harnesses that
+# embed `python3 -c "import jsonschema; ..."`):
+#   - scripts/verify-plugin.sh                       (profiles schema check)
+#   - tests/fixtures/security/verify-security.sh     (I-7 / S-3 defenses)
+#   - tests/fixtures/seed-expectations/verify-seed-expectations.sh
+#   - tests/e2e/mock-bootstrap.sh                    (previews schema, fail-closed in CI)
+#   - scripts/generate-spec-anchor-audit.py          (optional; degrades gracefully)
+# ---------------------------------------------------------------------------
+jsonschema>=4.0,<5.0

tools/capture-gallery-hero.py

@@ -16,6 +16,15 @@
 
 Determinism: fonts loaded, animations disabled, viewport pinned, file://
 URI. Re-running on the same gallery.html produces a byte-stable PNG.
+
+Setup (#95 / #94 follow-up — Playwright is now a pinned dev dependency):
+
+    python3 -m pip install -r requirements-dev.txt
+    python3 -m playwright install --with-deps firefox chromium
+
+See requirements-dev.txt and CONTRIBUTING.md ("Python dev setup") for the
+full contract. Previously this script relied on an ambient `playwright`
+install; the pin makes it reproducible on a fresh clone.
 """
 from __future__ import annotations