test(svg-renderer): add visual-fidelity test for sanitizeSvgText

[cwillisf]

Resolves

Adds a second axis of coverage for sanitizeSvgText — pixel-level fidelity — in service of the SVG sandbox work that's about to start. No behavior change.

Proposed Changes

• New tap test at packages/scratch-svg-renderer/test/visual-fidelity.js. Renders the cat costume SVG twice — once raw, once after sanitizeSvgText — and asserts the canvases are pixel-identical (tolerance 0).
• A second assertion pins a committed PNG snapshot of the sanitized render at test/snapshots/cat-costume.sanitized.png. Future runs assert against this baseline, so drift in the sanitizer, fonts, or canvas/librsvg surfaces as a test failure on its own — not just relative to the raw input.
• New shared fixture at test/fixtures/cat-costume.svg, extracted from scratch-vm/test/fixtures/default.sb3's bcf454ac…svg.
• node-canvas added as a devDep for the rendering primitive.

Reason for Changes

The existing test/sanitize-svg.js asserts string equality between raw fixtures and .sanitized.svg companions. That's good for catching policy changes, but it can't catch a sanitizer change that quietly alters rendered pixels — say, a future tightening that drops a fill rule or a presentation attribute that the policy file accidentally categorizes as ornamental. The pixel-level check covers the gap.

The committed snapshot is a separate kind of guarantee from the cross-comparison: even if sanitizeSvgText is byte-for-byte unchanged, a font asset update or a librsvg upgrade that subtly alters rendering would be invisible to the cross-comparison (raw and sanitized both render the new way) but visible against the snapshot.

Test Coverage

• npm test --workspace=packages/scratch-svg-renderer passes locally (168 / 168 tap tests with the new file).
• npm run build --workspace=packages/scratch-svg-renderer succeeds.

[github-actions]

Test Results

    8 files  ±0  1 114 suites  +3   12m 19s ⏱️ - 1m 13s
2 845 tests +4  2 837 ✅ +4   8 💤 ±0  0 ❌ ±0 
6 471 runs  +7  6 432 ✅ +7  39 💤 ±0  0 ❌ ±0 

Results for commit 7646525. ± Comparison against base commit a6fc6e4.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Adds pixel-level (“visual fidelity”) regression coverage for sanitizeSvgText in @scratch/scratch-svg-renderer, complementing the existing string-equality sanitizer tests and supporting upcoming SVG sandbox work.

Changes:

• Add a new Tap test that renders the same SVG before/after sanitizeSvgText and asserts pixel-identical output.
• Add a committed PNG snapshot baseline for the sanitized render, plus a shared cat-costume.svg fixture.
• Add canvas (node-canvas) as a devDependency to enable headless rendering in tests (with corresponding lockfile updates).

Reviewed changes

Copilot reviewed 2 out of 5 changed files in this pull request and generated 1 comment.

File	Description
packages/scratch-svg-renderer/test/visual-fidelity.js	New pixel-diff and snapshot-based visual regression tests for sanitizeSvgText.
packages/scratch-svg-renderer/test/fixtures/cat-costume.svg	New shared SVG fixture used for visual fidelity rendering.
packages/scratch-svg-renderer/package.json	Adds canvas devDependency needed by the new test.
package-lock.json	Lockfile updates for canvas and its transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 5 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.