Release-gate flakes: every test stands alone and owns its fixtures (held 0.7.144 and 0.7.146) #2229

This pull does part (1) of #2219 and nothing else. The #845 privacy test in test/looks.test.ts no longer depends on a picture an earlier test captured.

What changed

• The test ("a public app made private after its pictures were taken…") now makes its own public app vault, a branch and a pull.
• It writes the thumb, desktop and phone pictures itself and records them as takenAs: "nobody". The old version took the first good phone look that an earlier test had captured with a real browser, and that look was missing on the runner.
• The assertions are unchanged except that they now use the vault paths.
• bun test test/looks.test.ts -t "made private after its pictures" passes alone. tsc --noEmit is clean.
• The full test/looks.test.ts run gives 13 pass and 1 fail. The failure is "a real capture through the grant door, with /usr/bin/chromium". It fails the same way on the base branch in this sandbox, so I treated it as the sandbox's browser and left it alone.
• I didn't run the terminal-health test that failed the check on the closed pull #2226. This change touches only the looks test, so I can't say whether that failure was flaky or something else.

What I left out

• Part (2), the nightly lane that runs every gate file one test at a time and with --randomize. It is a CI and infrastructure change of its own and should be a separate issue.
• Part (3), a skip with a named reason for tests that need a browser or a host file. That also covers the real-capture test above, which should be skipped rather than fail when the browser is absent. Splitting it off would also cover the other flakes the issue lists (0.7.139, 0.7.142, 0.7.144).

To try it Run bun test test/looks.test.ts -t "made private after its pictures".

Closes #2219