[WEB-005] Make capture freshness and PNG verification dependency-complete

[veryCrunchy]

User problem

The visual QA catalog can report committed screenshots as current even when renderer build inputs change, and CI does not fully decode committed PNG files before publication. This can leave reviewers with stale or unreadable visual evidence.

Acceptance criteria

• Capture freshness includes every repository build input that can change Compose/Skia rendering, including root Gradle configuration and the version catalog.
• The website verifier fully decodes every committed PNG and rejects truncated or corrupt images.
• Focused tests cover renderer dependency changes and PNG data that has a valid signature/IHDR but cannot be decoded.
• Website tests, client/SSR/prerender build, and Docker build pass.

Relationships

Follow-up hardening for #224 and PR #225.