Clears 15 of the 17 Dependabot alerts on the root pnpm-lock.yaml, and removes a build toolchain from a repo meant to ship from source with no build step.

Why

@wordpress/scripts was used for exactly one thing: wp-scripts test-playwright and its base Playwright config, in the plugin e2e suites. In exchange it pulled in webpack, Babel, stylelint, markdownlint, and Jest, which brought markdown-it, uuid, postcss-selector-parser, @babel/core, and others into the alerts. @wordpress/jest-console wasn't imported anywhere.

What changes

• playwright.config.base.js at the root has the same settings as the wp-scripts config, minus its global setup, which every plugin already replaced with its own. hwp-previews, wpgraphql-logging, and hwp-documents import it by relative path and run plain playwright test. Nothing is generated or copied.
• Removes @wordpress/scripts and @wordpress/jest-console from the root and the plugins.
• Removes the Playwright tooling from wpgraphql-debug-extensions and wpgraphql-webhooks, which have no e2e tests.
• Bumps @wordpress/e2e-test-utils-playwright from 1.54 to 3.1, which clears the extract-zip and OpenTelemetry alerts. Its breaking changes are a higher Node minimum and two helpers (switchEditorTool and setGutenbergExperiments) that no spec uses.
• Raises the root engines.node to >=22.19.0, which e2e-test-utils 3.x requires. CI already runs Node 24, and .nvmrc is lts/krypton.
• pnpm-lock.yaml drops about 12,600 lines.
• The e2e workflow installs browsers with the locked Playwright (pnpm exec playwright install --with-deps chromium) instead of pnpm dlx, which fetched the newest Playwright and could drift from the locked @playwright/test. It now installs Chromium only, since that's the only project the config runs.

Remaining alerts

• http-cache-semantics comes in through @wordpress/env 12, which is already the latest, and there's no upstream fix.
• braces is a withdrawn advisory.
• The six Nuxt example alerts need a Nuxt 3 → 4 migration, which belongs in a separate PR.

Testing

• playwright test --list loads each plugin's config and finds every spec: hwp-previews 20 tests, wpgraphql-logging 8, hwp-documents 3.
• Checked that no vulnerable version of the cleared packages is left in the lockfile.
• I couldn't run the e2e suites locally because they need the Docker WordPress environment. The e2e workflow only runs the first changed plugin's suite (hwp-documents here), so it's worth running hwp-previews and wpgraphql-logging by hand before merging.