fix(tests): harden docker-run.sh argument and image-hash handling

Two papercuts hit while regenerating baselines for the fix in this PR:

- `vitest --run -u <filter>` parses <filter> as the *value* of `-u`, so the
  filter is dropped and the whole suite runs in update mode. The
  `e2e:updateSnaps` script ends in `-u`, so any filter a caller appends
  (as CLAUDE.md instructs) lands in exactly that trap - which silently
  rewrote an unrelated, flaky `deleteShallowerBlock` baseline. `-u` /
  `--update` is now always passed last.

- wasm-pack emits `packages/xl-typst-compiler/pkg/package.json`, which the
  image content hash globbed, so building the wasm that docker-run.sh
  itself requires invalidated the image. A fresh clone paid two full image
  builds. `pkg` is now pruned alongside `dist`.

Author: YousefED

.claude/skills/testing-skill/SKILL.md

@@ -55,7 +55,7 @@ bash tests/docker-run.sh -e CI=1 -- --run [filters]
 
 A specific test file may be targeted by appending (part of) its name as a filter. A single browser may be targeted with `--project "e2e (chromium)"`. Individual tests in a file may be disabled using `skip`, i.e. `test.skip("Test name", ...)` (remember to revert this once all tests pass).
 
-Screenshot baselines can be regenerated with the `-u` argument, which must come **after** the filters (`--run <filters> -u`): written as `--run -u <filter>`, the filter is parsed as the flag's value and the **whole** suite runs in update mode, silently rewriting unrelated baselines. Note that `-u` only rewrites baselines whose comparison **fails** — a small intended change (e.g. a short text edit) that fits inside the suite's 2% pixel tolerance leaves the baseline stale while the test passes. To force a fresh capture, delete the baseline file first. Baselines are per-browser (`<name>-<browser>-linux.png`); after regenerating, always inspect the images before committing them.
+Screenshot baselines can be regenerated with the `-u` argument. Vitest parses `--run -u <filter>` with the filter as the _value_ of `-u`, which drops the filter and runs the **whole** suite in update mode; `docker-run.sh` now normalizes this by always passing `-u`/`--update` last, so either order is safe through the script (invoking vitest directly still is not). Note that `-u` only rewrites baselines whose comparison **fails** — a small intended change (e.g. a short text edit) that fits inside the suite's 2% pixel tolerance leaves the baseline stale while the test passes. To force a fresh capture, delete the baseline file first. Baselines are per-browser (`<name>-<browser>-linux.png`); after regenerating, always inspect the images before committing them.
 
 When testing a visual change, prefer writing screenshots to verify that the change is working as expected.
 

tests/docker-run.sh

@@ -26,10 +26,28 @@ done
 [ "$#" -gt 0 ] && shift
 entrypoint_args=("$@")
 
+# `vitest --run -u <filter>` parses <filter> as the *value* of `-u`, so the
+# filter is dropped and the whole suite runs in update mode, silently rewriting
+# unrelated baselines. The `e2e:updateSnaps` package script ends in `-u`, which
+# puts any filter a caller appends into exactly that trap. Re-order defensively
+# so `-u`/`--update` is always passed last, after the filters.
+update_flags=()
+filtered_args=()
+for arg in "${entrypoint_args[@]}"; do
+  case "$arg" in
+  -u | --update) update_flags+=("$arg") ;;
+  *) filtered_args+=("$arg") ;;
+  esac
+done
+entrypoint_args=("${filtered_args[@]}" "${update_flags[@]}")
+
 # Auto-rebuild the image if its content hash label doesn't match the current
 # repo state. The hash covers every file that affects the image's contents: the
 # Dockerfile itself, plus everything it bakes in — the lockfile, workspace file,
-# all package.json files, patches, and example sources. When they differ the
+# all package.json files, patches, and example sources. Generated output dirs
+# are pruned: `pkg/` is wasm-pack's, and it emits a package.json, so without
+# that prune, building the wasm this script *requires* would itself invalidate
+# the image and force a second full rebuild. When they differ the
 # image is rebuilt in place
 # (Docker's layer cache makes this fast when only a leaf changed).
 _dep_files() {
@@ -42,7 +60,8 @@ _dep_files() {
     find . -name package.json \
       -not -path '*/node_modules/*' \
       -not -path '*/.git/*' \
-      -not -path '*/dist/*'
+      -not -path '*/dist/*' \
+      -not -path '*/pkg/*'
   } | sort -u
 }
 _content_hash() {