feat(review): GitHub-Actions build-and-serve fallback for repos with no CI preview deploy

[JSONbored]

Part of #3607 (visual-capture convergence epic).

Context

src/review/visual/preview-url.ts's discovery chain (explicit url_template → Deployments API → check-run scan → bot-comment scan, per #3609) covers any repo whose CI already produces a preview deploy. Some self-hosted repos have NO CI-produced preview deploy at all — this issue is only for that gap. Not needed for gittensory-ui or metagraphed once their own preview setups are configured.

Requirements

• Mirror this repo's OWN ci.yml fork-safety discipline exactly: secrets withheld from pull_request-triggered runs (check how ci.yml branches Codecov upload on head.repo.fork, re-grep current line numbers before implementing) — follow the identical pattern.
• The capture job gets contents: read only, zero secrets.
• Handoff to the bot happens via a workflow_run webhook on completion — the bot fetches artifacts using its OWN already-trusted GitHub App installation token, NEVER a token minted inside the untrusted job.
• Pin the dispatched workflow to the trusted default-branch ref so a contributor can never smuggle a modified workflow file through their PR branch.
• Explicitly do NOT build a custom sandbox (Firecracker/gVisor/etc.) for this — GitHub Actions already gives free, ephemeral, isolated compute for untrusted PR code on public repos, matching this repo's own existing trust boundary for its own CI. Building a bespoke sandbox re-solves a problem GitHub already solves.
• Extend the existing SSRF allowlist (isSafeHttpUrl, used in preview-url.ts/shot.ts) to cover this new ephemeral-runner-served URL source — it was built/reviewed against GitHub Deployments/commit-check/bot-comment sources, not an ad-hoc runner URL.

Deliverables

• New workflow file implementing the fork-safe build-and-serve pattern
• workflow_run webhook handoff using the bot's own trusted installation token
• Workflow ref pinned to default branch
• SSRF allowlist extended for the new URL source, with tests
• Docs: when this fallback activates vs. the existing discovery chain

Expected outcome

A self-hosted repo with no existing CI preview deploy still gets automated before/after captures, without weakening the trust boundary the rest of the pipeline already relies on.

Effort

M-L — a new fork-safe CI workflow plus the SSRF-allowlist extension; the security discipline matters more than the code volume here.

[linear-code]

JSO-3162