fix(cli): add .playwright-cli/ to .gitignore on workspace install

[Yury Semikhatsky (yury-s)]

Summary

• playwright-cli install now appends .playwright-cli/ to .gitignore, since traces and storage state saved there can contain credentials.
• Best-effort: only in a git repo, skipped if the entry is already present, a write failure warns instead of failing the install.

Fixes #42307

[github-actions]

Test results for "MCP"

1 failed
❌ [chrome] › mcp/config.spec.ts:203 › chromiumSandbox › --sandbox enables the sandbox @mcp-ubuntu-latest-chrome

8122 passed, 1341 skipped

---

Merge workflow run.

[github-actions]

🟢 CI is clear — the one failure is a pre-existing, not caused by this PR

Hi, I'm the Playwright bot and I took a first look at the CI failure here.

The only failing test is mcp/config.spec.ts:203 › chromiumSandbox › --sandbox enables the sandbox on mcp-ubuntu-latest-chrome. That test fails 25 of 25 runs on that exact bot across many unrelated SHAs and PRs — it's a pre-existing environment failure, not something this PR touched.

Details

Overall: this PR only appends .playwright-cli/ to .gitignore in cli-daemon/program.ts (plus a test in cli-misc.spec.ts). Nothing in the diff reaches Chromium sandbox config, so it can't explain the failure.

Pre-existing failure / infra

• [chrome] › mcp/config.spec.ts:203 › chromiumSandbox › --sandbox enables the sandbox @mcp-ubuntu-latest-chrome — this is not a flake, it's a consistent failure on that platform. In the test-results DB the test has failed 25/25 runs on mcp-ubuntu-latest-chrome while passing 32/32 on mcp-macos-latest-chrome and 31/31 on mcp-windows-latest-chrome. The failures span unrelated SHAs and PRs (e.g. chore(html-reporter): render a thumbnail for every trace attachment #42289, fix(chromium): stop disabling BoundaryEventDispatchTracksNodeRemoval #42294, feat(browserContext): add windowState option #42286, feat(webkit): roll to r2354 #42303, feat(mcp): add browser_emulate_media tool and --color-scheme option #42244, and plain push runs), so it predates and is independent of this PR. Looks like the sandbox genuinely can't be enabled in the Ubuntu CI container and the test isn't gated for it.

  Run history on mcp-ubuntu-latest-chrome (all red, every run):

  🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

Nothing here is on this PR to fix — the CI signal is clean for the change.

_{Triaged by the Playwright bot - agent run}