fix(render): align container Chrome with the CLI - #5338

What

Use chrome-headless-shell@152.0.7977.30 in the Cloud Run and regression-test images, matching the CLI's pinned Chrome build. Gradient text now includes child glyphs when a transform creates a separate paint layer.

Why

Chrome 148 omits the transformed child's text from a background-clip: text mask. The same HTML paints both lines with Chrome 152. The existing chat fixture also loses its final gradient heading with 148, so its MP4 baseline is regenerated with 152.

Related work

Fixes #5117. Thanks to the reporter for the reproduction and Arcade fork patch. #5207 covers gradient contrast inspection and is already merged; this change addresses the renderer image pins. The Cloud Run BeginFrame build contract from #2817 remains enforced.

How

Change both exact browser pins together, add a one-second nested-composition regression with identical direct and transformed text, and register it in the shard schedule. The fixture's compiled snapshot and MP4 are uploaded through Git LFS, along with the regenerated chat MP4. The chat source and compiled snapshot stay unchanged.

Test plan

• Build Dockerfile.test for Linux/amd64 with the new pin and build the Cloud Run beginframe-contract target. Its production Chrome flags produce a PNG through HeadlessExperimental.beginFrame; the packaged browser also paints the layered gradient text.
• The new fixture fails all 100 visual checkpoints with the exact Chrome 148 executable (minimum PSNR 26.19) and passes all 100 with the exact Chrome 152 executable through BeginFrame. Strict HTML lint and browser checks pass, including contrast checks for both text rows.
• The existing chat baseline passes with a Chrome 148 control. Chrome 152 restores the missing final heading; regenerating only its MP4 makes all 100 visual checkpoints and the audio comparison pass.
• All 50 regular in-process fixtures (including the new regression) and both distributed fixtures pass compilation, visual, and audio comparisons with Chrome 152. This is the configured PR corpus; the nightly-only fixture and the usual transparency/WebGPU exclusions are outside this run.
• Fresh workspace build, all 101 Cloud Run package tests, 7 BeginFrame probe tests, 21 shard-plan tests, 19 regression-harness tests, repository lint, formatting, test reachability, and comment checks pass.
• Normal commit hooks pass. GitHub verifies the commit signature, its tree matches the locally tested commit, and all three LFS files are readable from the fork with matching SHA-256 hashes.

Local corpus validation uses Linux/amd64 emulation on macOS. Slow public S3, GSAP, and font downloads were cached through a test-only preload using verified original bytes; fixture URLs, sources, and quality gates are unchanged. Stalled captures were retried sequentially. PRODUCER_LOW_MEMORY_MODE=false avoids the local 8 GiB VM's automatic low-memory routing; the existing BeginFrame capability probe still controls fallback. Cloud Run validation covers the image's build contract rather than a deployment.