CI: drop Playwright source-build mode, add preview URL comments

[Rachael-Graham]

Remove the temporary source-build mode and related flags/logic now that a published kagent chart is available
Clean up docs and the kagent-kind provisioner to always install the published chart; update README text to explain past captures and recapture guidance.

Also add a PR comment step (with explicit permissions) to the preview workflow so preview URLs are posted/updated on the pull request, and clarify live-cluster job comments in the screenshots workflow. Files changed: .github/workflows/playwright-screenshots.yaml, .github/workflows/preview.yaml, docs-site/playwright/README.md, docs-site/playwright/provisioners/kagent-kind.sh.

[github-actions]

Docs preview

Link	Points at
Branch preview	The newest push to this branch. Updates in place.
Commit preview	d335134 only. Frozen.

Both are uploaded Worker versions and serve no production traffic.

[kristin-kronstain-brown]

Findings

Should fix

1. The README claims a dispatch run refreshes the captures, but no dispatch run has ever happened, and the PR step would fail anyway.
   docs-site/playwright/README.md lines 243-245 say a dispatch run refreshes these captures. The workflow comment in this same PR still calls the cluster job "unverified on a hosted runner", so the two files disagree. No workflow_dispatch run of playwright-screenshots.yaml has ever happened.
   Separately, all 7 runs of that workflow so far have failed at peter-evans/create-pull-request@v6 with Duplicate header: "Authorization". The cluster job uses the same step, so even a green capture could not open its PR. My best guess is that checkout@v7 and create-pull-request@v6 do not work together, and that a newer create-pull-request fixes it. I have not confirmed which version.
   This PR did not cause that failure, but its new README text depends on the step working. Suggested wording: "The chart now publishes, so the cluster job can install what a reader installs. The job has not had a green dispatch run yet."

2. The comment step finds its comment by marker only, not by who wrote it.
   .github/workflows/preview.yaml lines 131-132. If any person posts a comment that starts with <!-- preview-urls -->, the step tries to PATCH that person's comment. GITHUB_TOKEN cannot edit it, the step fails with a 403, and the preview job goes red even though the upload worked. Because of --paginate, the jq filter also runs once per page, so a match on two pages would put two IDs in $ID.

             ID=$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR}/comments" --paginate \
               --jq ".[] | select(.user.login == \"github-actions[bot]\" and (.body | startswith(\"${MARKER}\"))) | .id" | head -1)
   

3. The title covers only half the PR.
   The title says "drop source-build mode", but about 43 of the 70 added lines are an unrelated feature: the preview URL comment in preview.yaml. The description mentions it. Retitling is probably enough, though splitting would give cleaner history.

Nits (optional)

4. 1.0.0-alpha2 is hard-coded in the playwright-screenshots.yaml comment and in the README. Both will be wrong after the next pin bump. The conref versions/kagent.md is the source of truth, so "a published 1.x chart" would not go stale.

5. This predates the PR. .github/workflows/preview.yaml line 67 puts ${{ github.head_ref }} straight into a run: script. The job now also has pull-requests: write. Fork PRs still get a read-only token under pull_request, so the risk is low, but passing the value through env: is the standard fix.

6. This also predates the PR. The preview.yaml trigger types are only opened and synchronize, so reopening a PR does not refresh the preview comment. Adding reopened fixes it.