test: DFD visual-regression baselines stale since #676; dynamic TM names destabilize screenshots

[ericfitz]

Summary

All DFD VRT plates currently fail for two pre-existing, additive reasons — neither related to app rendering:

1. Stale baselines: PR chore: review all en-US localized strings for proper capitalization #676 (May 9, commit 5e08187) lowercased default node-shape labels ("Data Store" → "Data store", "Security Boundary" → "security boundary") but the VRT baselines were never regenerated. Plate 1's diff shows exactly this text-casing delta.
2. Unstable capture geometry: per-test threat-model names include a timestamp+suffix, so the header block's height varies run to run, cascading a vertical offset through every full-page screenshot (visible on plates with no text diff at all, e.g. plate 3).

Acceptance Criteria

• Stabilize capture: fixed-width/fixed-content header during VRT capture (static TM name for VRT fixtures, or mask/clip the header region in toHaveScreenshot).
• Regenerate all DFD VRT baselines after stabilization.
• Verify two consecutive clean runs produce zero pixel diff.

Notes

• Evidence gathered during deps: @antv/x6 major upgrade v2 -> v3 #446 E2E validation (2026-08-03): plates 1,2,3,4,6 mismatch at 3–9% pixels; plate 3 shows only the offset pattern (no casing diff), proving the causes are independent. Artifact paths recorded in the deps: @antv/x6 major upgrade v2 -> v3 #446 execution report.
• Related hardening: test: add Playwright webServer block so E2E never targets a stale dev server #827 (webServer block).