feat: per-step screenshot sink + push-gate hardening (4.3.0)

[KeyCode17]

Summary

Adds an opt-in visual trail of an agent run, and closes gaps found in a baseline-standards audit of the repo.

Screenshots were reachable only through the screenshot action, which returned base64 into an action result that nothing persisted. This adds a StepScreenshotSink port so the host project owns the destination — a database, object storage, anything — while FolderScreenshotSink ships as the batteries-included local-directory default. No storage dependency enters this workspace.

let history = RunAgent::new(task, llm, registry, browser, events)
    .with_screenshot_sink(Arc::new(FolderScreenshotSink::new("./shots")))
    .execute()
    .await?;

Files land at ./shots/<agent-uuid>/step-0000.png, zero-padded so lexicographic order matches run order. StepRecord.screenshot stores the location, not inline bytes, so history JSON stays small; the field is #[serde(default)] so older history still deserializes. Capture or save failure logs at warn and yields no artifact — a full disk never aborts a run.

ras-session carries the sink through SpawnParams.screenshot_sink, so the primitive lands with every consumer migrated in the same PR.

Also in here

Findings from a baseline-standards pass, each its own commit:

• bump-gate returned success when the version was unchanged, so pushes landed with no bump and the size was never checked. The root workspace version had drifted to 2.7.0 while v4.1.0 was tagged. It now derives the required bump from what the branch adds to origin/main.
• check-commit-msg accepted chore(scope), docs(scope), an invented release: type, capitalized/period-terminated subjects, and AI attribution trailers.
• Docs sorted into docs/guides/ and docs/rfcs/; README linked a specs file that never existed.
• clear_context_cookies removed — no callers, silenced by allow(dead_code).

Debt fixed on the way through

RunStep::new took seven positional arguments and this needed two more, so it moves to a RunStepDeps parameter struct.

Verification

scripts/bump-gate.sh run end to end, not a dry run:

[bump-gate] 4.2.0 -> 4.3.0 (minor)
cargo build --workspace --all-targets    OK
cargo test --workspace --no-fail-fast    OK (38 passed, 0 failed, 2 ignored)
doc-tests, all crates                    OK
cargo run -p ras-cli -- --help           OK
[bump-gate] OK

Plus cargo fmt --all --check, cargo clippy -p ras-agent -p ras-session --all-targets -D warnings, and check-loc.sh / check-no-comments.sh / check-no-unwrap.sh on every changed .rs. Four new tests cover the folder sink: path layout, directory creation, jpeg extension, zero-pad ordering.

• Live browser run against a real CDP endpoint — the sink is covered by unit tests only; capture itself goes through BrowserPort::screenshot, which is exercised by the #[ignore]d live tests.

Notes for the reviewer

Two rules changed shape during this work and are worth an explicit look:

1. feat bumps minor, not major. The convention as originally written made every feature a major bump; 4.3.0 for a feature release is only consistent with minor. An explicit ! still forces major.
2. The bump is sized against origin/main, not the tracking branch. Caught by the real gate after the first push: once a branch is pushed, upstream becomes the branch, so a follow-up bump-only commit measured 2 files and demanded a patch.

lefthook is not installed in the working clone (.git/hooks/ is all .sample), so none of these gates fire automatically there — every check above was run by hand. lefthook install closes that.

Changelog entries for the 3.x line and 4.0.0–4.2.0 are still missing from CHANGELOG.md; noted in the file rather than left silently absent.