fix(engine): disqualify static-frame dedup on any tl.call()

Real bug report: a mono count span driven by a GSAP tl.call() (a counter
going "0 sur 0" -> "1 sur 1" at a later beat) rendered the LATER value
baked in from frame 0 of an EARLIER, unrelated static-hold span, despite
the dedup log reporting "verified".

Root cause: computeStaticFrameSet's tween walker only tracks property
tweens, so a call()-driven textContent mutation carries no tracked
interval and the span around it looks fully static. verifyStaticFramesSafe
does catch genuine drift WITHIN a run it's checking, but a call() is a
one-shot side effect wired as both onComplete and onReverseComplete (GSAP
has no separate "undo" — crossing it in either direction fires the SAME
forward mutation). Verifying a LATER run forward-seeks past the call(),
permanently mutating the live page; an EARLIER run already passed its own
check before that happened, so nothing re-verifies it afterward. Real
capture then starts on the same corrupted page and bakes the wrong value
into the earlier span's reused buffer.

No reliable way to tell a DOM-mutating call() from a harmless one
(analytics ping, class toggle) without executing it, so this disqualifies
the whole comp on ANY call() — conservative, costs some dedup perf on
comps that use call() harmlessly, but correctness over speed.

packages/engine/src/services/frameCapture-staticDedupTimelineCall.test.ts

@@ -0,0 +1,68 @@
+import { describe, it, expect, vi } from "vitest";
+import { computeStaticFrameSet } from "./frameCapture.js";
+
+/**
+ * Regression lock: a GSAP `tl.call()` disqualifies a composition from
+ * static-frame dedup, even though the tween walker can't see it as an
+ * "animated" interval (a call() carries no property change to track).
+ *
+ * `tl.call()` is a zero-duration tween whose vars wire the callback as
+ * `onComplete` (and `onReverseComplete` — GSAP fires the SAME forward side
+ * effect on backward crossing too, there is no separate "undo"). A one-shot
+ * DOM mutation driven this way (e.g. a counter's textContent) is not
+ * seek-idempotent: the static-dedup verifier's own arm-time seeking can
+ * permanently fire it while checking a LATER run, corrupting the page for an
+ * EARLIER, unrelated run's real capture — even though each run's own
+ * verification passes in isolation, so "verified" still gets logged. Real
+ * incident: tools-onboarding FR render, beat-1 title card baked in beat-6's
+ * counter value from frame 0 onward.
+ */
+describe("computeStaticFrameSet disqualifies a comp containing a tl.call()", () => {
+  function makePage(evalResult: Record<string, unknown>) {
+    return {
+      evaluate: vi
+        .fn()
+        // First call: the main computeStaticFrameSet in-page scan.
+        .mockResolvedValueOnce(evalResult)
+        // Second call: computeClipBoundaryFrames' own [data-start] scan.
+        .mockResolvedValueOnce([]),
+    } as unknown as Parameters<typeof computeStaticFrameSet>[0];
+  }
+
+  it("is ineligible when a tl.call() is present, even with zero tracked tween intervals", async () => {
+    const page = makePage({
+      intervals: [],
+      tweenCount: 1,
+      duration: 10,
+      hasVideo: false,
+      hasCanvas: false,
+      hasNonGsapAnim: false,
+      hasUnresolvableClipStart: false,
+      hasTimelineCall: true,
+    });
+
+    const result = await computeStaticFrameSet(page, 30);
+
+    expect(result.eligible).toBe(false);
+    expect(result.reason).toContain("tl.call()");
+    expect(result.staticFrameSet.size).toBe(0);
+  });
+
+  it("stays eligible on an otherwise-identical comp with no tl.call()", async () => {
+    const page = makePage({
+      intervals: [],
+      tweenCount: 1,
+      duration: 10,
+      hasVideo: false,
+      hasCanvas: false,
+      hasNonGsapAnim: false,
+      hasUnresolvableClipStart: false,
+      hasTimelineCall: false,
+    });
+
+    const result = await computeStaticFrameSet(page, 30);
+
+    expect(result.eligible).toBe(true);
+    expect(result.staticFrameSet.size).toBeGreaterThan(0);
+  });
+});