Great question, and I actually wanted to write a more detailed article about this. Until I get around to that, the steps are outlined below:
You can use the encryptOverrides function (see docs) to programmatically create an override for the feature flags you need. You can then make playwright forward this override as the vercel-flag-overrides cookie from tests.
These overrides will be respected by the Flags SDK even without the _vercel_session and __vercel_live_token cookies. Note that if you are testing a preview deployment you will need to bypass deployment protection (docs).
Here is a snippet of what this could look like roughly:
https://gist.github.com/dferber90/ee146a4d09eb036cd0066d07134fd598
It is a slightly cumbersome having to set a cookie in Playwright and we are considering extending the Flags SDK to also accept overrides as a regular header, which will make it even easier to override.