refactor: restore pngjs codec

[thymikee]

Summary

Restore pngjs as the bundled PNG codec and remove the bespoke codec introduced in #609.

The existing worker, resize, screenshot-diff, and canonical error contracts remain intact. pngjs is bundled into the published output, adds no transitive dependencies, and replaces the custom codec implementation and its codec-specific test suite. The change touches 12 files and stays within the PNG utility and bundling scope.

Validation

PNG worker, resize, and screenshot-diff tests pass. The related Vitest suite passes with VITEST_MAX_WORKERS=1, and tooling checks covering formatting, lint, typecheck, layering, fallow, metadata, declarations, and production bundling pass.

The full affected gate later hit an unrelated 5-second timeout in ensureXctestrunArtifact aborts only the disconnected request build and preserves concurrent unrelated builds; CI remains authoritative for that lane.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-07-30 12:13 UTC

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	1.88 MB	1.90 MB	+22.3 kB
JS gzip	605.4 kB	611.4 kB	+5.9 kB
npm tarball	724.1 kB	730.4 kB	+6.4 kB
npm unpacked	2.53 MB	2.56 MB	+22.4 kB

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.1 ms	26.9 ms	-0.2 ms
CLI --help	57.6 ms	56.0 ms	-1.6 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/png-worker-contract.js	+30.6 kB	+9.4 kB
dist/src/runtime.js	-22 B	-104 B
dist/src/apps.js	+3 B	-3 B
dist/src/runner-disposal.js	+3 B	-2 B
dist/src/internal/daemon.js	+3 B	+1 B

[thymikee]

Code review is clean at 75702d80: pngjs is bundled, has no transitive dependencies, the worker/resize/diff routes consistently use the shared codec, canonical decode errors remain wrapped, and CI is green.

One validation gap remains before merge: exact-head smoke/package jobs do not execute the bundled codec through diff screenshot, and the PR has no retained live simulator/device artifact evidence. Please run the built or packaged CLI against a live captured baseline/current pair, retain the JSON result and generated diff PNG, and add a focused installed-package regression if practical. This verifies both bundling and the real capture→decode→diff→encode route.