Pre-install MCP server deps in copilot-setup-steps

Warm the npm cache for the stdio MCP servers the Copilot coding agent
launches (@playwright/mcp, fast-filesystem-mcp, octocode-mcp,
yggdrasil-mcp) and install Chromium for the playwright server, so they
start reliably once the agent runtime firewall is enabled.

https://claude.ai/code/session_01AfnF51garpZ7ajmV6M7ZMF

Author: Ven0m0

.github/workflows/copilot-setup-steps.yml

@@ -13,6 +13,10 @@ permissions:
   contents: read
 
 jobs:
+  # NOTE: The job MUST stay named `copilot-setup-steps` or the Copilot coding
+  # agent will not pick it up. These steps run BEFORE the agent's firewall is
+  # enabled, so anything the agent's MCP servers need at runtime should be
+  # downloaded/cached here.
   copilot-setup-steps:
     runs-on: ubuntu-latest
     steps:
@@ -22,6 +26,31 @@ jobs:
         with:
           node-version: "24"
 
+      - name: Pre-install local (stdio) MCP server packages
+        shell: bash
+        env:
+          NPM_CONFIG_FUND: "false"
+          NPM_CONFIG_AUDIT: "false"
+        run: |
+          set -euxo pipefail
+          # The agent launches these servers via `npx -y <pkg>@latest`. Installing
+          # them globally warms the npm cache so they resolve quickly/offline once
+          # the runtime firewall is in place. Keep this list in sync with the
+          # `type: "local"` servers in the repo's Copilot MCP configuration.
+          npm install -g \
+            @playwright/mcp@latest \
+            fast-filesystem-mcp@latest \
+            octocode-mcp@latest \
+            yggdrasil-mcp@latest
+
+      - name: Install Playwright browser (Chromium)
+        shell: bash
+        run: |
+          set -euxo pipefail
+          # The playwright MCP server needs a browser binary present. Fetch
+          # Chromium and its OS dependencies before the firewall blocks downloads.
+          npx --yes playwright install --with-deps chromium
+
       - name: Note Windows validation workflows
         shell: bash
         run: |