ref(preprod): Revert odiff CLI-mode workaround after v4.3.8 fix

[NicoHinderling]

Reverts the odiff CLI-mode workaround (#112829) now that odiff-bin v4.3.8 ships the upstream fix for the server-mode stdin buffer reuse bug (dmtrKovalenko/odiff#170). Snapshot comparison goes back to using server mode — one persistent subprocess per batch instead of spawning one per comparison.

Dependency pin

odiff-bin is pinned to exact 4.3.8 (no caret) in package.json, pnpm-lock.yaml, and the CI workflow. Exact pin keeps dev / prod / CI in lockstep with minimal machinery.

Bonus fix — binary resolution

_find_odiff_binary() now points at node_modules/odiff-bin/bin/odiff.exe instead of raw_binaries/odiff-<platform>. v4.3.8's post_install.js only sets the execute bit on bin/odiff.exe; the raw binaries ship without +x, which was causing PermissionError on fresh installs. Despite the .exe suffix, this is the package's cross-platform entrypoint on all OSes.

Minor cleanup

Extracted _fetch_batch_images helper in tasks.py so the per-batch closure / lock / cache setup lives in one place instead of being rebuilt inside every loop iteration.

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[sentry]

Bug: The OdiffServer is started unconditionally, causing the compare_snapshots task to fail if the odiff binary is unavailable, even when no images need diffing.
_{Severity: HIGH}

Suggested Fix

The OdiffServer should only be started if there are batches to process. Wrap the with OdiffServer() as server: block in a conditional check, such as if batches:, to ensure it only executes when there is diffing work to be done. This restores the previous behavior of avoiding subprocess creation for zero-diff scenarios.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/preprod/snapshots/tasks.py#L533-L534

Potential issue: The `OdiffServer` is initialized unconditionally via a `with` statement
before iterating through image batches. In scenarios where no images require diffing,
such as when all images are identical, the `eligible` and `batches` lists will be empty.
Despite having no work to do, the `OdiffServer` still attempts to start its subprocess.
If the `odiff` binary is missing or has permission issues, this raises an unhandled
exception, causing the entire `compare_snapshots` task to fail. Previously, the server
was only started if there were batches to process, avoiding this failure.

_{Did we get this right? 👍 / 👎 to inform future reviews.}