ci: split into two jobs and embed the render preview - #16

The artifact link in the comment is the only way to look at the render when
inline embedding is unavailable, and until now clicking it downloaded a zip
containing one PNG.

GitHub added unzipped artifacts in February: `actions/upload-artifact` v7 with
`archive: false` stores the file as-is, so a browser that can display the type
opens it directly. That turns the link from "download, unzip, look" into "look".

scripts/probe-browser.ts is deleted. It existed to prove a browser was available,
that text could be measured, and that screenshots were deterministic — all three
are now exercised on every run by the UI suite and the preview script. What it
left behind was a fourth copy of the Chromium launch flags, and a stale copy at
that: the missing `--user-data-dir` was fixed in the preview script while this
one sat unchanged, which is exactly the failure mode that copying causes.

`gh run download` fails on non-zipped artifacts with 'zip: not a valid zip
file' — the CLI still assumes every artifact is an archive (cli/cli#13012).
`gh api .../artifacts/<id>/zip` returns the raw body, which for an unzipped
artifact is the PNG. Verified by downloading this run's artifact and checking
the file type.

The comment has been linking to a file the reader had to fetch. Now it shows the
picture.

The URL had to be one GitHub serves as an image, and that ruled out everything
tried so far:

- artifacts need auth, and their URLs redirect to HTML
- release assets come back as `application/octet-stream` with
  `Content-Disposition: attachment`, so they are treated as a download
- `gh --attach` needs the web upload endpoint, which an API token cannot call

A file on a branch is served by raw.githubusercontent.com as `image/png`. That is
the only form that renders, and it is what reg-actions and awesome-copilot both
document. The image is committed to a dedicated `render-preview` branch — force
pushed, one file, no history — from a scratch directory so the checked-out tree
is never touched.

`?v=<short sha>` busts the CDN cache, otherwise a re-render would show the
previous image for a few minutes.

This also removes the attach-and-fall-back dance entirely: there is no longer any
path where the comment posts without an image. The artifact upload stays, as a
30-day copy that does not depend on the branch.

One job was wrong. The browser-only work forced `contents: write` onto every
step, including the ones that only read code and run assertions.

Two jobs now, each asking for what it uses:

    checks   format -> types -> test:coverage -> build        (contents: read)
    ui       build -> test:ui -> render -> publish -> comment (contents: write)

The second builds its own dist/ rather than uploading and downloading it between
jobs — a round trip through an artifact is slower than the three seconds the
build takes.

Publishing also skips itself when the render is byte-identical to what the branch
already holds. Rendering is deterministic, so documentation-only pushes now leave
no dangling blob behind.

The comment explained what the pipeline was rather than what to look at. It now
says the image comes from the latest code on the branch, names the specific
failures worth scanning for, and links to the run that produced it.

One shared `preview.png` meant every run overwrote the file that every earlier
comment pointed at. Open an old pull request and its screenshot had silently
become a picture of newer code.

The filename carries the full sha now, so a comment and the commit it describes
stay together. That also removes the `?v=` cache-buster — a new name is a new
URL.

The branch grows by one file per commit instead of staying at one, which is the
cost of not rewriting history. Worth watching; if it becomes noise, the old
approach of pruning to the last N is a small change.

Keeping every preview meant keeping a commit per push, and a preview is useful
while the pull request is open and not much after. The old force-push behaviour
is right; the per-commit filename is what was actually needed.

The branch now holds one commit with one file, named after the commit it
renders. An old pull request whose commit has been garbage-collected shows a
broken image — clearly gone, rather than silently swapped for a newer picture,
which is what a shared filename did.

Also drops the clone-and-compare step: force-pushing a fresh repo is both
simpler and correct, since nothing is being appended to.

The branch is force-pushed, so a preview survives until its commit is
garbage-collected. Say so where the image is, rather than leaving somebody to
discover it as a broken link months later.