fix(ci): build site before capturing visual baselines

[cuberhaus]

Problem

The Refresh visual baselines workflow failed at Capture baselines with:

```n
## Cause

In CI, Playwright's `webServer` runs `npm run preview:static` (serves the prebuilt `dist/`) — it does **not** build. The capture job went straight from installing browsers to `playwright test --update-snapshots` with no `npm run build`, so `dist/` never existed, the preview server served nothing, and Playwright timed out after 240s.

## Fix

Add a `Build site` step (`npm run build`) before the capture step, mirroring the working `playwright` jobs in `test.yml`.

## Validation

- `actionlint` clean.
- Matches the build+preview pattern already proven green by `test.yml`'s playwright jobs.
- Workflow is `workflow_dispatch`-only, so it won't run on this PR — trigger it manually from the Actions tab after merge.

[cursor]

Security review

Result: No high-confidence vulnerabilities found.

This PR adds a single CI step (npm run build) to .github/workflows/visual-baselines.yml before Playwright captures visual baselines. The change aligns that workflow with the existing playwright-visual job in test.yml.

Scope reviewed

Area	Assessment
Injection (command, path, template)	None. The added step is a static npm run build invocation with no user-controlled inputs.
Authn / authz	Unchanged. Workflow remains workflow_dispatch-only; trigger permissions are unchanged.
Secrets / logging	Unchanged. No new secrets, tokens, or log output.
SSRF / XSS / deserialization	Not applicable. No runtime application code or network-facing logic changed.
Supply chain	Unchanged. No new dependencies or third-party actions introduced.

Context

In CI, Playwright's webServer runs npm run preview:static (serves prebuilt dist/) and does not build. Without an explicit build step, the preview server had no artifacts to serve. Adding npm run build fixes that operational gap and matches the pattern already used in test.yml.

Pre-existing notes (not introduced by this PR)

• The workflow already grants contents: write and pull-requests: write and uses peter-evans/create-pull-request@v8 to open baseline-refresh PRs. That is intentional for this automation; only users who can manually dispatch workflows can trigger it.
• Anyone with workflow_dispatch permission can regenerate committed snapshot PNGs. That is a process/integrity consideration, not a new exposure from this diff.

No remediation required for security purposes.

  

_{Sent by Cursor Automation: Find vulnerabilities}