ci: reuse the headless-chrome action in the browser job

Same three steps the examples workflow needs, and the comment explaining
the AppArmor sysctl now lives in one place.

.github/workflows/ci.yml

@@ -119,27 +119,8 @@ jobs:
           go-version-file: go.mod
           cache: true
 
-      # Pin stable: a dev Chromium's remote-debugging socket is flaky under
-      # the driver, even though the browser otherwise launches headless.
-      - name: Set up Chrome
-        uses: browser-actions/setup-chrome@v2
-        with:
-          chrome-version: stable
-
-      # Ubuntu 24.04 (current ubuntu-latest) restricts unprivileged user
-      # namespaces via AppArmor, which stops headless Chrome from starting even
-      # with --no-sandbox: the process launches but never opens its DevTools
-      # socket. Re-enable them so the driver's Chrome can come up.
-      - name: Allow Chrome under unprivileged user namespaces
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
-      # Fail here with Chrome's own stderr if the browser can't launch, instead
-      # of letting the driver report an opaque DevTools timeout downstream.
-      - name: Verify headless Chrome starts
-        run: |
-          chrome --version
-          chrome --headless --no-sandbox --disable-gpu --disable-dev-shm-usage \
-            --dump-dom 'data:text/html,<title>ok</title>'
+      - name: Set up headless Chrome
+        uses: ./.github/actions/headless-chrome
 
       - name: Drive web fixtures through headless Chrome
         run: make test-browser