docs(docker): install the browser with the project Playwright, not vpx

The GitLab and derived-image examples used `vpx playwright install`, which
downloads the latest Playwright and can fetch a browser revision different from
the project lockfile, missing the baked cache at test time. Use
`vp exec playwright install` after `vp install` so the browser matches the
version the tests resolve.

Addresses Codex review feedback.

Author: fengmk2

docs/guide/docker.md

@@ -151,16 +151,26 @@ test:
   image: ghcr.io/voidzero-dev/vite-plus:latest
   script:
     - vp install --frozen-lockfile
-    - vpx playwright install --with-deps chromium
+    - vp exec playwright install --with-deps chromium
     - vp test
 ```
 
+`vp exec` runs the project's own Playwright (from your lockfile), so it installs
+the browser revision your tests expect. Prefer it over `vpx playwright install`,
+which would download whatever Playwright is latest and can fetch a different
+browser revision.
+
 To bake the browser and its libraries into a derived image instead of installing
-them on every run, do it in a build stage (root is available through `sudo`):
+them on every run, install the project dependencies first so the baked browser
+matches your lockfile, then install with the project's Playwright (root is
+available through `sudo`):
 
 ```dockerfile [Dockerfile]
 FROM ghcr.io/voidzero-dev/vite-plus:latest
-RUN vpx playwright install --with-deps chromium
+WORKDIR /app
+COPY --chown=vp:vp package.json pnpm-lock.yaml pnpm-workspace.yaml .node-version* ./
+RUN vp install --frozen-lockfile
+RUN vp exec playwright install --with-deps chromium
 ```
 
 If Chromium crashes under load in CI, give the container more shared memory with