ci(a11y): launch Chrome with --no-sandbox for pa11y-ci

The a11y job never ran to completion: it `needs: build`, which was
always failing, so it was skipped. With build fixed, a11y now runs and
Chromium aborts on the runner — "No usable sandbox!" — because recent
Ubuntu runner images disable unprivileged user namespaces.

Add .pa11yci.json launching Chrome with --no-sandbox (safe in ephemeral
CI) and pass it via --config to both pa11y-ci invocations.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: snapsynapse

.github/workflows/build.yml

@@ -82,12 +82,13 @@ jobs:
           if [ -f docs/sitemap.xml ]; then
             SITE_BASE=$(grep -oE '<loc>[^<]+</loc>' docs/sitemap.xml | head -1 | sed -E 's|<loc>(.+)/?</loc>|\1|' | sed -E 's|/$||')
             npx --yes pa11y-ci \
+              --config .pa11yci.json \
               --sitemap http://localhost:8088/sitemap.xml \
               --sitemap-find "$SITE_BASE" \
               --sitemap-replace 'http://localhost:8088' \
               --threshold 0
           else
-            npx --yes pa11y-ci http://localhost:8088/ --threshold 0
+            npx --yes pa11y-ci --config .pa11yci.json http://localhost:8088/ --threshold 0
           fi
 
 # GitHub Pages serves directly from `main` branch root on this repo.

.pa11yci.json

@@ -0,0 +1,8 @@
+{
+  "defaults": {
+    "standard": "WCAG2AA",
+    "chromeLaunchConfig": {
+      "args": ["--no-sandbox", "--disable-setuid-sandbox"]
+    }
+  }
+}