fix(e2e): don't disable TLS validation in committed code

schema-compat set NODE_TLS_REJECT_UNAUTHORIZED=0 process-wide (CodeQL
js/disabling-certificate-validation, high). A real stand has a valid
cert; only the local self-signed Tier-2 stack needs it, so the operator
now opts in via their own shell env, never in code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/docs/e2e.md

@@ -114,7 +114,8 @@ Before the browser specs, a **schema-compat pre-flight**
 validates every frontend operation against it — a renamed or missing field
 fails once, readably, instead of as dozens of red specs (the deploy-skew class
 we hit manually). Run it anywhere: `E2E_BASE_URL=https://… node
-e2e/tools/schema-compat.mjs`.
+e2e/tools/schema-compat.mjs` (against the local self-signed Tier-2 stack,
+prefix `NODE_TLS_REJECT_UNAUTHORIZED=0`; a real stand has a valid cert).
 
 ## Trends and selective runs
 

frontend/e2e/tools/schema-compat.mjs

@@ -27,9 +27,9 @@ if (!BASE_URL) {
     process.exit(2);
 }
 
-// Node rejects the stack's self-signed cert otherwise; the target is trusted by
-// virtue of being the URL we were told to check.
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+// A real stand has a valid cert. Only the local self-signed Tier-2 stack needs
+// TLS verification relaxed — the operator opts in for that with
+// `NODE_TLS_REJECT_UNAUTHORIZED=0 node …` in their own shell, never in code.
 
 // Despite the name, this file holds the frontend's operations (named queries /
 // mutations / subscriptions + fragments), not a schema.