[AZ-456] Fix playwright-runner Dockerfile: install unzip before bun

The Playwright base image
(mcr.microsoft.com/playwright:v1.49.1-noble) ships without
unzip, which bun's curl|bash installer requires:

  error: unzip is required to install bun
  process "/bin/sh -c curl -fsSL https://bun.sh/install ..."
    did not complete successfully: exit code: 1

Found while user asked the agent to attempt to bring up the
suite-e2e compose stack. Latent bug — the runner image had
never been built successfully in any local workspace before.

Test report (test_run_report.md) updated with the concrete
error trace from the up attempt: the 6 azaion/<S>:test
service images are pull-access-denied (not in any reachable
registry from this host), confirming the legitimate
external-service env block. Local-build half (azaion-ui,
owm-stub, tile-stub, playwright-runner) is healthy.

No e2e tests were executed; Step 7 verdict unchanged
(PASS_WITH_DOCUMENTED_GATE; e2e deferred to CI / merge lane).

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/03_implementation/test_run_report.md

@@ -43,15 +43,24 @@ User-approved (option A) per test-run skill section 5. All 13 are quarantine mar
 
 All 13 satisfy the test-run skill's "feature-flag-gated test whose feature is intentionally disabled in this environment" pattern (broadened: feature-not-yet-built). None are flaky-test quarantines, missing-fixture, missing-credential, or service-not-running. They're tracked in F-CUM-3 (cumulative 04–06) and F-CUM-5 (cumulative 07–08) as Phase B / Step 9 work.
 
-## Environment Block — e2e Profile (User-Approved Defer)
+## Environment Block — e2e Profile (User-Approved Defer + Confirmed by `docker compose up`)
 
-User-approved (option A): treat static + fast as the Step 7 per-commit gate; defer e2e to the dev/stage merge lane / CI runner that has registry access.
+User-approved (option A on first prompt): treat static + fast as the Step 7 per-commit gate; defer e2e to the dev/stage merge lane / CI runner that has registry access.
 
-**Block**: the UI's `e2e/docker-compose.suite-e2e.yml` references service images
-`azaion/{admin,flights,annotations,detect,loader,resource}:test` that:
+User-approved (option A on follow-up): try to bring up the e2e stack to capture a concrete error trace.
 
-- are not available locally (`docker image ls` shows zero `azaion/*` images),
-- are not buildable from sibling-repo source today (e.g. `/Users/obezdienie001/dev/azaion/suite/annotations/` has no `Dockerfile`),
+**Concrete error trace captured 2026-05-11**:
+
+- `docker pull azaion/admin:test` → `Error response from daemon: pull access denied for azaion/admin, repository does not exist or may require 'docker login'`. Same shape for `azaion/{flights,annotations,detect,loader,resource}:test`.
+- `docker compose -f e2e/docker-compose.suite-e2e.yml up -d` aborted on the first failed pull (`azaion/annotations`); no service started; no playwright tests executed.
+- Local-build half is healthy: `e2e-azaion-ui`, `e2e-owm-stub`, `e2e-tile-stub`, `e2e-playwright-runner` all built successfully (after the bug fix below).
+
+**Bug found and fixed during the up attempt**: `e2e/runner/Dockerfile` — the `RUN curl -fsSL https://bun.sh/install | bash` step failed with `error: unzip is required to install bun` because the Playwright `mcr.microsoft.com/playwright:v1.49.1-noble` base image ships without `unzip`. Fixed by prepending `apt-get update && apt-get install -y --no-install-recommends unzip` to the same RUN. The local image now builds cleanly and is tagged `e2e-playwright-runner:latest`.
+
+**Why the suite images are unreachable**:
+
+- not available locally (`docker image ls` showed zero `azaion/*` images before the up attempt),
+- not buildable from sibling-repo source today (e.g. `/Users/obezdienie001/dev/azaion/suite/annotations/` has no `Dockerfile`),
 - are normally pulled from the project's CI registry by the suite-level harness `/Users/obezdienie001/dev/azaion/suite/e2e/run-local.sh` via `docker compose pull --ignore-pull-failures` — that path needs registry auth not configured in this workspace.
 
 This matches the test-run skill's "Stubs are allowed only for external systems outside the product boundary" — every blocked image is an external-service from the UI's perspective and is the canonical SUT, not a faked internal module. The block is legitimate per skill section 0 #2.