Settle external SVG images before visual capture

[chubes4]

Summary

Normalize bounded same-origin external SVG images through Blob-backed decoding before screenshots.

What changed

• Fetch eligible same-origin SVG bytes with timeout and size bounds, render them through temporary Blob URLs, decode them, and revoke URLs after capture.
• Extend browser coverage to prove an already-complete same-origin SVG takes the Blob-backed decode path.

How to test

1. Run npm install; expect Dependencies install successfully..
2. Run npm run build; expect TypeScript packages build successfully..
3. Run npm exec -- tsx tests/browser-visual-compare-capture-reliability.test.ts; expect The capture reliability suite passes, including same-origin external SVG Blob normalization..

Compatibility

No command or output schema changes. Raster, responsive, cross-origin, oversized, and failed SVG requests retain their existing paths.

Evidence

• Base advanced after verification: verified main at 7b1e774; publication observed c4cb30a. Candidate ancestry was validated against the verified snapshot.
• CI expected: Repository CI
• Durable run execution: Failed
• Reviewer-resolvable source evidence: Visual compare can capture complete external SVGs before embedded fonts settle #1902
• Verified finalization base: main at 7b1e774
• gate-1: Passed

AI assistance

• AI assistance: Yes
• Tool(s): OpenCode and Homeboy
• Model: openai/gpt-5.6-sol
• Used for: Downstream evidence analysis, implementation, browser tests, and verification with Chris Huber.

Source relationships

• Closes Visual compare can capture complete external SVGs before embedded fonts settle #1902

[chubes4]

Downstream acceptance failed. The exact PR build completed the canonical solved 15-saas fixture matrix with 100% native conversion, zero invalid blocks, complete font embedding (3/3 expected SVGs), and unchanged outer image geometry, but the result remained exactly 8,300 / 9,958,080 mismatched pixels (0.08%). The same eight regions remain confined to text inside two SVG mockups.

This disproves both candidate hypotheses for this fixture: calling decode() for complete images and rehydrating same-origin external SVGs through Blob URLs do not change the output. This PR should not be treated as satisfying issue #1902 acceptance criterion 4. The next investigation should capture bounded source/generated SVG payload hashes and effective text/font attributes to locate deterministic serialization differences before changing capture behavior again.