fix(ci): preserve visual reports during preview deploy

[cixzhang]

Summary

• preserve pr/<number>/visual/ when replacing a PR's Storybook and Sandbox preview
• add a same-PR regression so preview deployment cannot silently delete published visual evidence

Why

A live audit found #5682 had a successful visual-acceptance status pointing to a 404. Its later preview deployment replaced all of pr/5682/, including the sibling visual/ tree.

Test plan

• pnpm exec vitest run .github/scripts/lib/gh-pages-publisher.test.mjs
• pnpm exec prettier --check .github/scripts/lib/gh-pages-publisher.mjs .github/scripts/lib/gh-pages-publisher.test.mjs
• pnpm check:repo
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 30, 2026 4:42pm

[github-actions]

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

[cixzhang]

Semantic verdict: request changes

Thanks—this fixes the deletion path, but a later preview deploy can still replace the trusted visual evidence a maintainer is trying to review. replacePreviewContents() skips visual, then copyContents(storybookDir, destination) accepts it again; my exact-head probe changed seeded “newer trusted evidence” to PR-controlled artifact bytes. Please make pr/<number>/visual/ write-protected for both removal and copy, and add that collision as a regression. Retry, idempotency, other-PR, and cleanup paths otherwise held.

[Reviewed by Robohands]

[cixzhang]

Semantic verdict: approve

Thanks—this is an approve once you undraft. A reserved visual artifact now rejects before any destination mutation; retry, idempotency, cleanup, and cross-PR isolation still hold.

Full review

[Reviewed by Robohands]