chore(deps): automate screenshot evidence and update source-map-js

[dependabot]

Dependency updates can pass behavioral checks and still block on stale screenshot provenance. This updates source-map-js from 1.2.1 to 1.2.2, narrows freshness inputs to the resolved build/capture dependency graph, and refreshes this PR's evidence with every canonical PNG unchanged.

• Unrelated lint/test updates no longer invalidate screenshots; shared build dependencies still do.
• Read-only CI captures eligible Dependabot candidates and retains a seven-day before/after gallery.
• Trusted main-branch tooling validates the exact PR/run/base, dependency-only changes, quality gates, scene/browser contracts, and actual PNG bytes. Only identical images permit an atomic manifest-only commit and exact-head CI dispatch.
• Changed screenshots retain human review. Automation never approves or merges PRs; release verification stays read-only.
• CI checks out its triggering commit directly, while dispatch validation binds that commit to the live Dependabot head.

Validation on final head cb4777c:

• Every GitHub check passed, including the complete CI quality gate (Chromium/WebKit), dependency review, and CodeQL with no new alerts.
• Local tooling (239 tests), unit (697 tests), build, example/type checks, screenshot validation, and clean-tree installed-consumer tarball verification passed. Forced CI-mode candidate capture preserved tracked files and matched all ten originals.
• The final local three-engine run had 688 passes, five expected skips, and two Firefox navigation timeouts before product assertions. Both traces show HTTP 200 for the document and every asset, a rendered calendar, and no page errors. Each affected test then passed its focused rerun plus three diagnostic repeats with zero retries and unchanged timeouts. Original diagnostics are retained locally. This does not establish a reliable Firefox gate; the earlier complete local gate on 3948d47 passed all 690 browser tests. Local Firefox used the documented Windows outer-sandbox opt-in.

Automation activates after merge into main. One initial keyboard-focus capture varied at 143 pixels (maximum channel difference 8); its cause remains unresolved. No changed PNG was accepted, and automatic promotion rejects such variations.