fix(evals): screen build-image keys the CI image on the merge commit it tests (#3962)

* test(evals): build-image must key the screen's image on its merge commit (fails on main)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix(evals): screen build-image keys the CI image on the merge commit it tests

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

* fix: pre-landing review fixes (superseded screens build no image)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

---------

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

.github/workflows/evals.yml

@@ -76,7 +76,13 @@ jobs:
     # (EV6, fork port wave 2). Skip the build for dependabot; the evals job's
     # explicit actor guard mirrors it because no eval test selects on a lockfile-only
     # diff — a maintainer's next push rebuilds the image with real perms.
-    if: github.actor != 'dependabot[bot]'
+    # A dispatched screen's slices test inputs.screen_merge_sha, so the image is
+    # keyed and built from that commit's bun.lock, not the dispatch ref's (screen
+    # 41662815506 ran Playwright 1.64.1 against main's Chromium). It waits for the
+    # route job, which refuses a screen of a fork or closed PR, and skips a
+    # superseded screen, whose slices plan nothing.
+    needs: [route]
+    if: github.actor != 'dependabot[bot]' && needs.route.outputs.superseded != 'true'
     runs-on: ubicloud-standard-8
     timeout-minutes: 15
     permissions:
@@ -87,6 +93,9 @@ jobs:
       runtime-id: ${{ steps.runtime.outputs.id }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.screen_merge_sha || github.sha }}
+          persist-credentials: false
 
       - id: meta
         # Key on Dockerfile + lockfile only. package.json is deliberately NOT