ci: Cut redundant work from the CI run

- Save the Rust cache only on main; pull requests restore it.
- Check bindings against the file nextest's export_bindings already wrote
  instead of compiling the test again.
- Run e2e in its own job on the Playwright image, in parallel with the
  frontend checks, without installing browsers on each run.
- Cancel a run in progress when a newer push arrives, on main too.

.github/workflows/ci.yml

@@ -7,7 +7,8 @@ on:
 
 concurrency:
   group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  # A newer push supersedes the run in progress, on main too.
+  cancel-in-progress: true
 
 env:
   CARGO_TERM_COLOR: always
@@ -29,7 +30,10 @@ jobs:
         with: { node-version: 22, cache: pnpm }
       - uses: dtolnay/rust-toolchain@stable
         with: { components: "clippy, rustfmt" }
+      # Only main saves the cache (saving takes minutes on Windows); PRs restore main's.
       - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: taiki-e/install-action@nextest
       - name: Linux deps
         if: runner.os == 'Linux'
@@ -45,9 +49,10 @@ jobs:
       # Test fixtures write LF files; keep Git from converting them on checkout.
       - run: git config --global core.autocrlf false
       - run: cargo nextest run --workspace --no-fail-fast
+      # nextest ran export_bindings, which rewrites src/bindings.ts.
       - name: Bindings are up to date
         if: runner.os == 'Linux'
-        run: pnpm gen:bindings && git diff --exit-code src/bindings.ts
+        run: git diff --exit-code src/bindings.ts
 
   frontend:
     name: Frontend
@@ -63,8 +68,22 @@ jobs:
       - run: pnpm lint
       - run: pnpm test
       - run: pnpm build
-      - run: pnpm exec playwright install --with-deps chromium
+
+  e2e:
+    name: E2E
+    runs-on: ubuntu-24.04
+    # Browsers and their system libraries are preinstalled; keep the tag in step with @playwright/test.
+    container: mcr.microsoft.com/playwright:v1.64.1-noble
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with: { version: 11 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 22, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
       - run: pnpm e2e
+        env:
+          HOME: /root
       - uses: actions/upload-artifact@v4
         if: failure()
         with: