test(imaging): broaden coverage across contract, transcode, routing and pixels

Environment-independent contract tests (cache headers + source, CORS, OPTIONS
preflight, negative figure/badge tables, concurrency burst) run in both the
deploy gate and the cross-browser job.

CMS-only /imaging assertions (webp/avif transcode, animated-APNG passthrough,
s-maxage edge caching) live in cms-imaging.spec.ts and are skipped behind the
edge proxy; the public topology has its own public-routing.spec.ts smoke that
fails if the edge ever stops fronting the imager or starts shadowing the CMS
endpoints. A committed per-engine visual baseline pins the static render.

The cross-browser imaging job is now blocking (IMAGING_EDGE=1), so avatar
imaging on chromium/firefox/webkit is a required signal.

.gitea/workflows/ci.yaml

@@ -117,15 +117,15 @@ jobs:
           retention-days: 14
 
   # Cross-browser imaging: the deploy gate only runs chromium, so this verifies
-  # a real render (decode + APNG animation) across every bundled engine against
-  # the public site. Non-blocking: it hits the live service, so transient
-  # network/edge hiccups must not fail the pipeline; the blocking contract
-  # checks live in the deploy gate (e2e/imaging/avatar-endpoint.spec.ts).
+  # a real render (decode + APNG animation + visual baseline) across every
+  # bundled engine against the public site. Blocking on purpose: this is the
+  # signal that avatar imaging works on every system, so a failure here must
+  # stop the pipeline. IMAGING_EDGE marks the target as edge-fronted, enabling
+  # the public-routing smoke and skipping the CMS-only /imaging assertions.
   tests-imaging-browsers:
     needs: check
     if: gitea.event_name == 'push' && (gitea.ref_name == 'main' || gitea.ref_name == 'master')
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -142,6 +142,7 @@ jobs:
       - name: Cross-browser imaging checks
         env:
           PLAYWRIGHT_BASE_URL: https://epicnabbo.nl
+          IMAGING_EDGE: "1"
         run: pnpm test:imaging
 
   preflight: