fix(test): repair marketplace PNG fixture

[khoinguyenpham04]

What does this PR do?

Repairs the PNG served by the private marketplace-test plugin's fixture-image route. Its IDAT checksum was invalid (efbf6945 instead of efa2a75b), causing Firefox to report "Image corrupt or truncated" during the table E2E clipboard/save/publish test. Only the three incorrect checksum bytes change; the image data and dimensions stay the same.

Adds a direct browser-decoding regression through the real public plugin route, without loading the admin shell or relying on hydration timing. Chromium, Firefox, and WebKit run it in the table cross-engine lane. A focused test-plan rule ensures future marketplace fixture changes also select that lane; other plugin fixtures retain their existing coverage.

Standalone follow-up to the CI audit of #3824 and #3825, based on main. No linked issue. This does not alter either MCP/blocks PR, increase retries or timeouts, or address unrelated hydration/autosave flakes.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added and reviewed the user-facing changeset (if this PR changes a published package)
• New features link to an approved Discussion: not applicable to this bug fix.
• I have included screenshots below if this PR changes the UI

Translation, Discussion, and screenshots are not applicable: no production UI or strings change, and the fixture's pixel data is unchanged. No changeset is needed: @emdash-cms/plugin-marketplace-test is private and excluded from releases; the remaining changes are test/CI coverage.

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: Codex with GPT-6.1 Sol (gpt-6.1-sol); independent adversarial review with GPT-5.6 Sol (gpt-5.6-sol, xhigh). The persistent review converged clean after correcting a CI selection gap.

Screenshots / test output

Not applicable: no production UI changes.

• The new real-server Firefox regression fails before the checksum fix with page.evaluate: Invalid encoded image data.
• The new source-only test-plan regression fails before its rule with e2e_table: false; all 18 test-plan tests now pass, including on CI's Node 22.16.0.
• Browser-decoding regression: 10 repetitions per Chromium/Firefox/WebKit against Node (30 passed) and 10 Chromium repetitions against Cloudflare (10 passed), all with zero retries and two workers.
• Full cross-engine table suite: 21 passed, 1 existing skipped, zero retries.
• Plugin host suite on CI's Node 22.16.0: 39 passed, zero retries.
• Core SQLite/PostgreSQL coverage on Node 22.16.0: all 768 suites passed across two runs (10,960 tests passed, 8 skipped). The database run used fresh worker databases; the nine jsdom suites ran separately with the standard config.
• Local validation caveats: the first broad run hit an abandoned PostgreSQL schema through schema-agnostic test introspection. Fresh worker databases passed that migration test without changing or deleting existing databases. The temporary isolation setup then failed to load in nine jsdom suites; all 97 tests in those suites passed with the standard config. No migration or test-harness source changes are included.
• Root pnpm build, pnpm format, pnpm lint:quick, pnpm lint, and pnpm typecheck pass; type-aware lint JSON reports zero diagnostics.
• Independent GPT-5.6 Sol (xhigh) review: clean/convergence, no findings or remaining nits.
• Remote CI has not yet been verified; repeated local passes do not guarantee that all CI jobs are flake-free.

[changeset-bot]

⚠️ No Changeset found

Latest commit: fc124a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://noah-fix-marketplace-png.try.emdashcms.com, https://noah-fix-marketplace-png-emdash-playground.emdash-cms.workers.dev (commit fc124a3)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://e0556520.try.emdashcms.com, https://e0556520-emdash-playground.emdash-cms.workers.dev	fc124a3	2026-10-03T22:26:44.481Z	Visit the dashboard ↗

[emdashbot]

This PR makes a focused, well-scoped repair: it corrects the IDAT CRC of the private marketplace-test plugin’s fixture PNG and adds a real-server, cross-browser regression test that proves the served bytes decode in Chromium/Firefox/WebKit.

I checked:

• The PNG checksum change: the IDAT CRC 0xefa2a75b matches the CRC-32 of the unchanged IDAT data, while the previous 0xefbf6945 was invalid.
• The new e2e/tests/plugin-fixture-image.spec.ts route (/_emdash/api/plugins/marketplace-test/fixture-image) is declared public: true in the plugin, so the unauthenticated request.get call is correct and no CSRF/auth setup is needed.
• The test exercises observable behavior (HTTP response code, image/png content type, browser decoding) rather than asserting the byte array back at itself.
• playwright.table.config.ts now includes the new spec in the table/cross-engine lane, and the Firefox/WebKit projects filter to @table-cross-engine as intended.
• The new test-plan rule for packages/plugins/marketplace-test/ selects e2e_table (plus unit/integration) while leaving other plugin fixtures on their existing plan.
• No changeset or i18n updates are required: @emdash-cms/plugin-marketplace-test is private: true, and the remaining changes are test/CI coverage.

The change is additive, low-risk, and directly guards against the Firefox “Image corrupt or truncated” regression described. No blocking issues or convention violations found.