CI gaps: viewer test:ci, pixel-rag:check, and the generated d.mts drift check

[ohdearquant]

CI currently builds the viewer and pins viewer/dist-static drift, but three checks the repo
already defines (or ships evidence for) never run in CI:

• Viewer unit tests: npm --prefix viewer run test:ci exists in viewer/package.json
  but no CI job runs it. The test job stages the viewer (npm ci + build +
  git diff --exit-code -- viewer/dist-static) and stops there.
• Pixel-RAG evidence check: pixel-rag:check validates the committed
  pixel-rag-bridge.json, but unlike its validators:check/firefly:check/
  preference-replay:check siblings it is not part of the build chain, so bridge drift
  lands silently.
• Generated type-declaration drift: generate-validators.mjs --check compares only
  src/generated/report-validators.mjs; the committed report-validators.d.mts beside it has
  no drift check, so a schema change that regenerates the module but not the declarations
  ships a stale type surface.

All three are additive jobs/steps on the existing workflow — no new tooling.

[ohdearquant]

Resolved by #63, with one scope note per item:

• Viewer unit tests: CI now runs test:ci:portable (validator drift check, typecheck, the vitest suite, build) plus the existing dist-static byte-identity gate. fixture:check is deliberately excluded and stays a local gate: the committed fixture's PNG bytes and score cascade are specific to the platform that generated it (image encoders and floating-point libraries differ across operating systems), so a CI regeneration drifts by construction — measured directly once the check's failure message learned to name the drifted paths (differing content_sha256/thumbnail bytes, threshold-cascaded score differences). The full test:ci, fixture check included, runs locally on the generating platform.
• Pixel-RAG evidence check: cannot run in CI at all — its inputs are locally recorded artifacts under the gitignored .cache/, so it is a local-only gate by construction, same class as fixture:check. Not wired into build for that reason.
• Generated type-declaration drift: generate-validators.mjs now owns report-validators.d.mts alongside the .mjs; --write regenerates both and --check fails on drift in either, and that check runs in CI via test:ci:portable.