Pull request previews

The default setup writes three cooperating workflows:

1. Render: capture the base and proposed theme revisions on each operating system, compare them and upload the images. Matching base captures are cached for later pushes to the same PR.
2. Publish: validate the artifacts, publish images to ci-previews, and create or update the preview comment. Unchanged views remain available as full screenshots.
3. Clean up: remove a PR's published images when it closes.

Preview comments start once the workflows are on the default branch. First-time contributor runs may need GitHub's approval step. Rendering PR content uses read-only permissions; the separate publisher can post comments but does not execute PR code.

The preview shows what changed, leaving the reviewer to decide whether it is correct. It does not reject a PR simply because the screenshots differ.