Add calibrated Chromium reference sentinel

[changeroa]

Purpose

Add an immutable, nonblocking Chromium geometry sentinel with a verified committed Linux calibration.

Environment and boundary

• Playwright 1.61.0.
• Digest-pinned linux/amd64 Playwright image.
• maxDiffPixels: 0 with no relaxation.
• Baseline-owner approval remains pending; jobs remain nonblocking.
• Geometry evidence does not certify typography, CJK, accessibility, or product suitability.

Verification

• Baseline 37/37, summarizer 23/23, governance suite PASS.
• Verified calibration: 20/20, identical PNG/DOM/AX hashes, min/mean/p95/max diff 0.
• Source run 29260372260; final fork validation run 29262012900.

node scripts/test-validate-baseline-manifest.mjs --json
npm run test:sentinel -- --reporter=line
node scripts/test-consumer-reference-sentinel.mjs

Durable evidence: .omo/evidence/consumer-reference-roadmap-implementation/pr4/.

Atomic history and rollback

1. 7422d31 Add calibrated Chromium reference sentinel
2. 8b8eaed Fix calibration checkout SHA capture
3. 3bfdd25 Fix calibration repository identity
4. bb772d3 Record Linux Chromium calibration

Revert these in reverse order. Base is codex/roadmap-03-reference-profiles; merge sequentially after roadmap 03.

[changeroa]

ULW triage: changes requested.

I reviewed exact head bb772d303c9dafea6e99d2c5713b4bd66e41a3bb against exact base 620d764e140da15f35830aadb27f3272aa2b52ed with five independent lanes, an isolated full workflow run, fresh Chromium capture, and two visual QA passes.

What passed:

• The isolated full workflow completed successfully.
• Fresh Chromium geometry capture is exactly identical to the committed 976×120 reference: 0 differing pixels and matching SHA-256.
• Baseline 37/37, calibration summarizer 23/23, renderer-purity, governance, and both semantic mutation controls passed in isolation.
• The referenced 20-run Linux artifact is currently live and its API identity/raw-tree digest match the committed calibration record.

Merge blockers:

1. scripts/test-consumer-reference-sentinel.mjs leaves test-results/**/error-context.md after its expected-failure cases. Running validate-okf next then fails on that ignored Markdown artifact. Give each negative case a disposable output directory and clean it in finally, or exclude Playwright outputs from repository Markdown discovery.
2. The “immutable” jobs use floating actions/*@v4 refs and only a Node-major identity. Pin actions to reviewed commit SHAs and record/validate the exact observed runtime. Later stack commits fix the action refs and credential persistence, but PR Add calibrated Chromium reference sentinel #23 does not.
3. The baseline source identity hashes only tests/helpers/render-consumer-reference.mjs, even though behavior comes from its scripts/pattern-data.mjs import. Bind the transitive canonical input (or a deterministic input-graph digest) into provenance.
4. Six new script entrypoints use new URL(import.meta.url).pathname, breaking checkout paths containing spaces/non-ASCII characters. Use fileURLToPath; this is fixed only in PR Harden cumulative reference evidence contracts #26 descendants.
5. Calibration producer, record, and verifier remain PR-controlled together. The current artifact checks out, but future completed evidence needs a protected/default-branch verifier or separately trusted attestation if it is to be treated as durable provenance.

Stack note: this PR is based on #22, already marked changes-requested. Its semantic-distinctness false success still exists at #26 head, so the stack cannot be merged through this PR yet.

Scope note: the visual PASS covers one 1024×768 geometry-only locator state. It does not certify typography/CJK, accessibility, owner approval, or product suitability.