chromium pair: label the channel in the header — pre-stable by design, 0/0/0 ≠ clean

The labeling half of pkgmgr-rs#646 option A: the fact that this pair rides
ahead of the stable channel (and therefore ahead of the CVE feed) now lives
in the files a packager actually opens, not in one issue's archaeology.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bryan-minimal

packages/chromium-bin/build.ncl

@@ -48,6 +48,14 @@ let liberation-fonts = import "../liberation-fonts/build.ncl" in
 # this case. The bare `chromium` name is intentionally left available
 # for a future source-built pkg.
 #
+# ⚠ CHANNEL: pre-stable BY DESIGN (pkgmgr-rs#646). This pair tracks
+# Playwright's pinned Chromium, which rides ahead of the stable channel
+# (the arm64 legs exist only for Playwright's revisions). CVEs are
+# published only against stable, so a 0/0/0 scan here means "ahead of
+# the published feed", NOT "audited clean" — and a held pin ages into
+# known-vulnerable as its major reaches stable. pkgmgr's nightly sweep
+# bumps the pair and alerts from the day that happens.
+#
 # Source mix — both legs are true open-source Chromium (BSD-3-Clause),
 # deliberately NOT Chrome for Testing: CfT is a *branded Google Chrome*
 # build governed by the Chrome ToS, which does not permit redistribution

packages/chromium-headless-shell-bin/build.ncl

@@ -46,6 +46,12 @@ let liberation-fonts = import "../liberation-fonts/build.ncl" in
 # rendering (mermaid-cli, e.g.) depend on this pkg alone to avoid
 # pulling the full browser.
 #
+# ⚠ CHANNEL: pre-stable BY DESIGN (pkgmgr-rs#646) — mirrors chromium-bin:
+# this pair tracks Playwright's pinned Chromium, ahead of the stable
+# channel. CVEs publish only against stable, so a 0/0/0 scan here means
+# "ahead of the published feed", NOT "audited clean". pkgmgr's nightly
+# sweep bumps the pair and alerts when the shipped major reaches stable.
+#
 # Source mix mirrors chromium-bin (see its header for the full
 # rationale): both legs are true open-source Chromium, deliberately NOT
 # Chrome for Testing (a branded Google Chrome build whose ToS does not