fix: message leak, dead report tests, gem packaging (3.0 readiness backlog) (#234)

Three independent beta2-review backlog items.

1. Vips::Image leaked into failure messages. ComparisonResult#to_h merged
   the whole meta hash, including the vips-only :diff_mask image object, so
   a failing assertion printed "diff_mask":"#<Vips::Image:0x...>". #to_h now
   excludes it; the object stays reachable via #diff_mask.

2. test/integration/report_screenshot_test.rb skipped all five tests unless
   RECORD_SCREENSHOTS -- the mode that records baselines rather than
   verifying them. Baselines existed only for macos/cuprite, so on the only
   CI platform (linux) there was nothing to compare against. Deleted, along
   with the orphan baselines. The HTML reporter keeps 18 unit tests, and
   `rake report:sample` already produces a sample report for eyeballing.

3. The gemspec shipped gems.rb, Rakefile and itself while omitting README.md,
   leaving a dead ../README.md link in the packaged docs. Replaced the
   deny-list regex with an allow-list: lib/, docs/, README, LICENSE, CHANGELOG.

Author: pftg

capybara-screenshot-diff.gemspec

@@ -15,9 +15,10 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.2"
   spec.license = "MIT"
   spec.metadata["allowed_push_host"] = "https://rubygems.org/"
-  spec.files = `git ls-files -z`.split("\x0").reject do |f|
-    f.match(%r{(^(\.|tmp|bin|test|spec|features|gemfiles|scripts|foo)/)|(^(\.|Dockerfile|CONTRIBUTING|README))})
-  end
+  # Allow-list: everything a consumer needs at runtime plus the shipped docs.
+  # Build/dev files (gems.rb, Rakefile, the gemspec itself, tests, CI) stay out.
+  spec.files = `git ls-files -z`.split("\x0")
+    .grep(%r{\A(lib/|docs/|README\.md\z|LICENSE\.txt\z|CHANGELOG\.md\z)})
 
   spec.bindir = "exe"
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }

lib/snap_diff/comparison_result.rb

@@ -67,8 +67,10 @@ def ratio
       meta[:difference_level]
     end
 
+    # Serializable difference metrics. The raw diff mask image is excluded —
+    # it is an image object, not a metric, and is reachable via #diff_mask.
     def to_h
-      {area_size: region_area_size, region: coordinates}.merge!(meta)
+      {area_size: region_area_size, region: coordinates}.merge!(meta.except(:diff_mask))
     end
 
     def coordinates

test/fixtures/app/doc/screenshots/macos/cuprite/html_report/report_annotated_both.png

@@ -41,6 +41,22 @@ class Reporters::DefaultTest < ActiveSupport::TestCase
       assert_not reporter.heatmap_diff_path.exist?, "heatmap diff should be cleaned"
     end
 
+    test "failure message reports metrics without leaking image objects" do
+      driver = SnapDiff::Drivers::VipsDriver.new
+      comparison = build_comparison_for(driver, "a.png", "b.png")
+      difference = driver.find_difference_region(comparison)
+      difference.meta[:difference_level] = 0.42
+
+      message = SnapDiff::Reporters::Default.new(difference).generate
+      metrics = message.lines.first
+
+      assert_includes metrics, "area_size"
+      assert_includes metrics, "region"
+      assert_includes metrics, "difference_level"
+      assert_not_includes metrics, "Vips::Image"
+      assert_not_includes metrics, "0x"
+    end
+
     private
 
     def build_comparison_for(driver, *images)