ci(#300): flaky-count honesty gate (annotate-first) + de-flake a perf unit test

[TortoiseWolfe]

Phase 3 of the #300 flaky cleanup: make a flake visible instead of laundered behind a green tick — plus fix the fifth flake this surfaced.

The gate (annotate-first)

retries: 2 reports a flake as a PASS — the job conclusion stays green, the rollup says CLEAN, and the only trace is a per-test github-reporter annotation nobody reads. That is how four flakes rode into main behind green checkmarks (#300). Nothing enforced the honesty rule "green conclusion ≠ 0 flaky".

Adds scripts/check-flaky-count.mjs + a Flaky-count honesty gate step in the report job. It does its own json merge of the blob reports, walks the merged report for tests Playwright marked flaky (failed an attempt, passed on retry), and surfaces them as one aggregated job-summary table + a GitHub annotation per flake.

• annotate (default): surfaces flakes loudly (::warning::) but exits 0 — goes green from day one while E2E flaky watch: game-3d touch-drag camera (new on #297's run; check main's next run) #300's four known flakes are still open, instead of redding main immediately.
• block: flip FLAKY_GATE_MODE: block (a one-word edit in e2e.yml) once those four are cleared → non-zero flaky becomes ::error:: + exit 1, and no NEW flake can ride in behind a green tick again.

Validated against a real Playwright report (a deliberately flaky browser-less test): annotate→warning+exit0, block→error+exit1, clean→"0 flaky"+exit0, missing→notice+exit0 (an infra gap never masquerades as a flake).

De-flake useColorblindMode perf tests

The pre-push gate caught a fifth flake while landing this: two "Performance" unit tests asserted a jsdom act() setState completes in <10ms (read 14.8ms under the loaded gate — and this runs in CI's unit suite too, so it can red main). Same wall-clock antipattern as the T148 backoff-ceiling fix (#315). They now assert the functional outcome (mode applied / patterns toggled) + a generous 1000ms pathological-slowness tripwire.

Verification

• type-check · lint · full unit suite · production build · Adding cesium inlines a WASM module as a template literal → vendor chunk fails to parse → client JS dead app-wide #294 chunk-parse all green (pre-push gate).
• The gate step first exercises live on this PR's own E2E run.

🤖 Generated with Claude Code