fix(engine,cli): resolve drawElement to a Chrome build that actually has it

canvas.drawElementImage is an unlaunched Dev/Canary-only Blink feature
(~151+). The CLI's pinned CHROME_VERSION fallback was still 131.0.6778.85 —
a puppeteer 24→25.2.1 bump that pinned it to Chrome Dev 151.0.7912.0 was
written on 2026-06-29 but never merged (orphaned local commit, no PR). Any
render on that pin, or on the shared puppeteer-cache binary, or on system
Chrome (Stable, no drawElementImage at all) got a canvas.getContext("2d")
missing the method and crashed mid-capture with "ctx.drawElementImage is
not a function" instead of falling back (HF#2060).

Three changes:
- Bump puppeteer/puppeteer-core to ^25.2.1 across every package that
  depends on it, and CHROME_VERSION to 152.0.7928.2 (today's Dev channel;
  confirmed via direct probe to implement drawElementImage, unlike 131).
- `ensureBrowser({ preferManagedChrome: true })`, always used by `render`:
  resolve straight to our pinned/cached build, skipping both the shared
  puppeteer-cache preference and system Chrome. Rendering shouldn't depend
  on whatever arbitrary Chrome a machine happens to have — that's exactly
  how this regressed (any Mac with Chrome.app installed bypassed the CLI's
  pin entirely).
- A runtime capability probe in the engine, right before any other
  drawElement work: if `drawElementImage` isn't a function on the injected
  canvas, route to the existing screenshot-fallback gate instead of
  crashing. This is the real backstop — it protects every resolution path
  (env override, stale cache entry, a future Chrome regression), not just
  the ones `preferManagedChrome` reaches.

Verified end-to-end: rendering against chrome-headless-shell 131 (confirmed
to lack drawElementImage) now falls back cleanly and produces a valid MP4
instead of crashing; rendering against a capable build still engages
drawElement normally. 922 engine tests + 1373 CLI tests pass.

Fixes #2060.

packages/cli/src/commands/render.ts

@@ -757,6 +757,10 @@ export default defineCommand({
     }
 
     // ── Ensure browser for local renders ────────────────────────────────
+    // Always resolve to our own pinned/managed Chrome, never a
+    // separately-installed puppeteer-cache binary or system Chrome — render
+    // behavior (drawElement support included, HF#2060) shouldn't depend on
+    // whatever arbitrary Chrome version happens to be on the machine.
     let browserPath: string | undefined;
     if (!useDocker) {
       const { ensureBrowser } = await import("../browser/manager.js");
@@ -769,13 +773,14 @@ export default defineCommand({
         | undefined;
       try {
         if (effectiveQuiet) {
-          const info = await ensureBrowser();
+          const info = await ensureBrowser({ preferManagedChrome: true });
           browserPath = info.executablePath;
         } else {
           const clack = await import("@clack/prompts");
           browserSpinner = clack.spinner();
           browserSpinner.start("Checking browser...");
           const info = await ensureBrowser({
+            preferManagedChrome: true,
             onProgress: (downloaded, total) => {
               if (total <= 0) return;
               const pct = Math.floor((downloaded / total) * 100);