screenshots: R2-hosted manifest becomes the baseline source of truth (morelli cutover)

The committed tests/screenshot-manifest.json is retired. CI now downloads
baselines/pcbjam/manifest.json (manifest v3, written only by the morelli
review app + its seed script) to the gitignored .baseline-manifest.json,
and everything downstream (pull, verify, compare) reads that copy:

- config.ts: MANIFEST_VERSION 3, MANIFEST_PATH .baseline-manifest.json,
  R2_BASELINES_MANIFEST_KEY; ManifestEntry grows opaque provenance
- r2-sync.ts: new --manifest mode (atomic fetch; no-creds skip DELETES a
  stale copy so the gate skips rather than using old baselines); --push
  gone (bytes enter the CAS only via morelli's promote)
- compare.ts: hard-skips when no manifest was fetched — a stale warm
  cache can never gate
- wasm-build.yml: fetch-manifest step before the baselines cache; cache
  key now hashes the fetched manifest; the gen-manifest --check lint gate
  goes with the committed manifest
- deleted: screenshot-manifest.json, promote.ts, changelog.ts,
  gen-manifest.ts, screenshot-changelog.yml, promote-screenshots skill
- docs (CLAUDE/README/TESTING/WHATWORKS/tools README): promote flow is
  now https://pcbjam-morelli-staging.pcbjam-staging.workers.dev

Validated locally against the real bucket: fetch-manifest (492), cold
pull 492 / warm pull cached=492, no-creds skip chain, compare gate skip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/tools/screenshots/r2-store.ts

@@ -99,6 +99,21 @@ export class R2Store {
         return 'uploaded';
     }
 
+    /**
+     * Download an ARBITRARY key (the R2-hosted baseline manifest) — unlike
+     * get(), not content-addressed, so no hash verification is possible; null
+     * on 404 so the caller can degrade like the no-credentials path.
+     */
+    async getKey(key: string): Promise<Buffer | null> {
+        const res = await this.fetchWithRetry(`${this.base}/${key}`, { method: 'GET' });
+        if (res.status === 404) {
+            await res.arrayBuffer().catch(() => undefined);
+            return null;
+        }
+        if (res.status !== 200) throw new Error(`GET ${key} → HTTP ${res.status}`);
+        return Buffer.from(await res.arrayBuffer());
+    }
+
     /**
      * Upload to an ARBITRARY key (the per-run uploads under runs/…, consumed by
      * the morelli review app) — unlike put(), not content-addressed and always