test: prove default controller preview parity

[neonwatty]

Summary

• build and authenticate flow-backed candidate and fixed/classic widgets from the same merge-group commit
• run the unchanged legacy/default, Radix, Chromium, Firefox, and WebKit preview suites against both artifacts
• compare candidate/classic Chromium test identifiers and outcomes exactly
• keep custom FlowConfig and the single structured Issue canary candidate-bound
• preserve failure diagnostics for either controller report

Compatibility boundary

This changes only the merge-group CI workflow and its fail-closed contract. Product/runtime code, Playwright configuration, E2E assertions/helpers, canary implementation, and release machinery are unchanged.

Verification

• workflow contract and adversarial mutation oracles
• release workflow: 193/193
• default-flow compatibility: 23/23
• production configuration: 5/5
• validate: 1420/1420
• full E2E: 317/317
• required PR review toolkit completed locally; one accepted failure-artifact finding fixed and independently re-audited

No release or production change is included.