The workflow now:
1. Runs --update-snapshots to write new/changed baselines
2. Commits any changes back to the branch
3. Fails the job if baselines changed, so the PR author is notified
This avoids silently accepting visual changes — the author must pull
and review the updated baselines.