The coordinator was disabled by `PR_READINESS_ENABLED=false` and still selected only the already-merged #372. Enabling it dispatched a Worker for #423, but [that Worker](https://github.com/githubnext/chopin/actions/runs/37908805153) reported an infrastructure blocker: its sandbox cannot reach Docker to start the browser-test databases.

This change limits readiness work to **open, non-draft, same-repository PRs, regardless of auto-merge**. It checks eligibility at discovery, readiness confirmation, Worker preparation, and immediately before publication, including PRs converted to draft during an attempt.

Trusted runner setup now installs PostgreSQL 17 and caches Chromium from main. A trusted helper starts five disposable databases inside the agent sandbox; the existing E2E runner uses their supplied URLs without Docker. Strict mode, agent privileges, network rules, write authority, and protected paths are preserved.

Validation: 207 maintenance tests passed; `bun run fix` and `bun run ci` passed; workflow compilation and GitHub Actions schema validation passed. A real PostgreSQL 17 probe confirmed UTF-8 databases, isolation, and idempotent setup. Both icon-size Chromium tests passed through `bun run e2e` using the four supplied databases, without Docker.

Rollout: the live switch is enabled for the current non-draft pilot (#419 and #423). After this PR lands, set `PR_READINESS_PRS=all` and retry #423 to verify a full repair in the actual sandbox. Docker image-build reproduction and unavailable cached browser revisions still produce explicit infrastructure blockers.

The diagram shows the new eligibility guards and the browser-test setup: