tests: move screenshot baselines from git to R2 (content-addressed manifest v2)

Baseline PNGs (492, 35 MB) leave git: they now live in the private R2 bucket
pcbjam-ci-screenshots as immutable sha256/<hex>.png objects, pinned by the
committed screenshot-manifest.json (v2: name, engine, sha256, bytes, dims).
tests/baseline-screenshots/ becomes a gitignored cache materialized by the new
`npm run screenshots:fetch` (r2-sync.ts + aws4fetch r2-store.ts).

- promote.ts: requires the RW keypair (shell env or gitignored tests/.env),
  syncs the cache, uploads new hashes BEFORE rewriting the manifest; the
  manifest diff is the only git-visible output. --prune only edits the
  manifest — R2 objects are never deleted, old commits still resolve.
- compare.ts: skips the gate (exit 0, no report.json) when the manifest
  expects baselines but the cache is empty (secretless callers).
- changelog.ts: diffs the manifest between revs and fetches bytes from R2;
  guards against the migration commit (base manifest not v2 → skip).
- gen-manifest --check: v2 schema + resurrection guard (fails if baseline
  PNGs are ever re-committed); credential-free so every caller can gate.
- wasm-build.yml: declares optional read-only S3 secrets, caches + fetches
  baselines before the lint gate; release.yml/deploy-staging.yml pass them.
- screenshot-changelog.yml: triggers on the manifest path instead of PNGs.

All 492 objects are seeded and hash-verified in the bucket; fetch/compare
degrade to a warn-and-skip without credentials.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/tools/screenshots/compare.ts

@@ -228,6 +228,16 @@ function main(): void {
         return;
     }
     const root = process.cwd();
+    // Baselines are a local cache fetched from R2 (`npm run screenshots:fetch`).
+    // When the manifest expects screenshots but the cache is empty — a secretless
+    // CI caller where the fetch step skipped, or a dev who hasn't fetched — skip
+    // the gate instead of misreporting every baseline as removed. No report.json
+    // is written; post-discord tolerates its absence.
+    const expected = loadManifest(root)?.screenshots.length ?? 0;
+    if (expected > 0 && listEngineKeys(path.join(root, BASELINE_ROOT)).length === 0) {
+        console.log('[compare] baseline cache is empty — run `npm run screenshots:fetch` (needs R2 credentials); skipping');
+        return;
+    }
     const report = classify(root, (args.sha as string) || process.env.GITHUB_SHA || null);
     fs.writeFileSync(path.join(root, DIFF_OUT_DIR, 'report.json'), JSON.stringify(report, null, 2));
     const { changed, added, removed, unchangedCount, driftLikely } = report;