after moving all to cipher

worker-toolkit-stocks-in-the-future/scripts/harbor-run

@@ -88,6 +88,22 @@ if [ ! -d "$WORKSPACE_DIR" ] || [ -z "$(ls -A "$WORKSPACE_DIR" 2>/dev/null)" ];
     exit 1
 fi
 
+# Preflight: recompute the browser marker from task.toml.
+#
+# `browser = true` decides whether the image installs Playwright, and a Dockerfile can only
+# learn it from its build context. build-workspace.sh writes the marker — but a task.toml
+# edited afterwards leaves it stale, and flipping the flag off would otherwise still build a
+# browser into a `browser = false` task. The file is derived, so there is nothing to preserve
+# by leaving it alone.
+BROWSER_OPTIN=0
+if [ -f "$TASK_DIR/task.toml" ] &&
+    grep -qE '^[[:space:]]*browser[[:space:]]*=[[:space:]]*"?true"?[[:space:]]*$' "$TASK_DIR/task.toml"; then
+    BROWSER_OPTIN=1
+fi
+if [ -d "$TASK_DIR/environment" ]; then
+    printf '%s\n' "$BROWSER_OPTIN" > "$TASK_DIR/environment/browser-optin"
+fi
+
 # Preflight: report — never block — on edits to toolkit-managed files.
 #
 # environment/Dockerfile, tests/test.sh and tests/grader-system-prompt.md ship from