feat: ship public site with SEO and visuals

Publish CMS content on public routes with responsive media,
accessibility checks, and deterministic visual baselines.

Co-authored-by: Cursor <cursoragent@cursor.com>

openspec/changes/build-public-site/specs/quality-gates/spec.md

@@ -0,0 +1,21 @@
+## MODIFIED Requirements
+
+### Requirement: Browser tests run against FrankenPHP-served application
+
+The system SHALL execute browser tests using Pest Browser/Playwright against an application served by FrankenPHP in CI. The `browser` job MUST cover the E2E journeys available in the current phase, the visual regression assertions and the automated accessibility checks for public routes, and MUST run in assertion mode without regenerating baselines (SPEC §13.4, §13.5, §13.8, §14.1).
+
+#### Scenario: Browser job validates served application
+
+- **WHEN** the `browser` CI job runs
+- **THEN** tests execute against the built application artifact or equivalent production-like image
+
+#### Scenario: Browser job covers visual and accessibility assertions
+
+- **WHEN** the `browser` CI job runs
+- **THEN** it MUST execute the visual regression suite and the accessibility suite
+- **AND** a failing snapshot or a critical/serious accessibility issue MUST block merge
+
+#### Scenario: Browser failures publish diagnostics
+
+- **WHEN** a browser test fails in CI
+- **THEN** the job MUST publish screenshots, snapshot diffs, application logs and browser logs as artifacts