Phase A of moving the AAQ scraper onto a Kubernetes CronJob. Pairs with platform-infrastructure#802 (manifests, ArgoCD app, Pulumi). Relates to #27, #28.

This PR is additive — it removes no working capability. It does not touch extension/, import_json.py, the CSV writers, or any workflow other than adding a new one.

Why

support.mozilla.org is behind a Fastly bot-challenge that fingerprints automated browsers and non-allowlisted source IPs, so the Playwright approach is dead (#28) and Actions runners can't reach the API.

The workloads EKS cluster's NAT egress IPs are already allowlisted — verified 2026-07-27 from a pod in each AZ using this branch's exact httpx client: 3.67.52.124 and 63.182.70.185 both return HTTP 200 + JSON, while the identical request from a non-allowlisted network returns the challenge HTML.

⚠️ A local run still raises ChallengeError. That is expected (your workstation isn't allowlisted) and is not an outage.

What's here

• sumo.py: Playwright → httpx. The SumoBrowser public API is frozen — class name, all __init__ kwargs, and the fetch_json/paginate method bodies are byte-identical. Only __init__/__enter__/__exit__/_raw_fetch changed, so no consumer needed edits, and the retry/deferral/challenge contract (ChallengeError, RateLimitDeferral, exit 75) is preserved.
• Playwright kept as an optional dependency group — uv sync --group playwright still runs poc.py. Not installed by default; verified absent from the image.
• Dockerfile — browser-free python:3.12-slim, arm64, nonroot.
• deploy/entrypoint.sh — clone → run_refresh.py → commit CSVs + .refresh-hwm → push with rebase-retry. PAT supplied via a git credential helper, never in argv or a URL.
• .refresh-hwm tracked in git (the pod is stateless; the repo is the state).
• aaq-scraper-image.yml — arm64 build → shared ECR via OIDC.
• Design + plan under docs/superpowers/.

Relationship to the browser extension

main moved on while this was in flight, and the extension is what currently produces data (imported through 2026-07-26); all three GitHub workflows are disabled_manually. This branch is merged up to date with that work and leaves it untouched.

Usefully, import_json.py reuses the scrapers' own writers (build_fieldnames, flatten_answer, COLUMNS), so extension-imported and run_refresh.py-generated CSVs are format-compatible — no churn if both run.

Open decision, deliberately not made here: whether the CronJob replaces the extension or runs beside it. Both would commit the same day-CSVs on main. The CronJob ships suspended, so this is decided at cutover, not at merge.

Testing

11/11 passing, plus container-level verification:

• tests/test_fetch_json.py — characterization tests stubbing only the transport, so they pin the retry/deferral/challenge semantics and passed against the old Playwright code before the swap and after it. Plus MockTransport tests for the httpx→dict mapping.
• tests/test_entrypoint.py — integration against a local bare git repo (no network/token): new CSV → one commit; unchanged run → none; and a competing push forces the rebase-retry path, asserting both commits survive.
• Real image under docker run --read-only: full clone → refresh → commit works, and uv run reuses the baked venv (sys.prefix=/app/.venv, no PyPI fetch) via the four UV_* vars now in the CronJob spec.

Review notes

Issues found and fixed during review:

• PAT was initially in the clone URL (visible via ps) → replaced with a credential helper.
• Image workflow interpolated ${{ github.event.inputs.tag }} into a run: block — script injection in a job holding ECR-push creds → passed via env + charset validation.
• arm64 build had no QEMU step; would have failed on merge.
• An earlier commit parking schema-check.yml was reverted — the workflow is already disabled at the GitHub level, so it changed nothing and its rationale was false.

Merge #802 first — it creates the OIDC role this repo's image workflow assumes.

🤖 Generated with Claude Code