#1326 fix(e2e): app.screenshot returns the absolute path of the file it wrote

What and why

• app.screenshot() returned the engine's attempt-relative path (screenshots/001-home.png). Tests have no handle on the attempt directory, so the path resolved against cwd to a file that never exists. Reported in #e2e-feedback: users globbed .e2e/results/**/screenshots/<basename> by mtime as a workaround.
• The fixture now joins it onto the attempt artifact dir and returns the absolute path (packages/e2e/src/run/fixtures.ts). The engine contract stays relative, so no engine changes.
• Docs, App type JSDoc and the e2e skill say "absolute path".
• The mobile benchmark's controls.e2e.ts asserted the old relative shape; it now checks absolute + file exists.

const shot = await app.screenshot('checkout');
// before: 'screenshots/001-checkout.png'
// after:  '<project>/.e2e/results/<test>/attempt-1/screenshots/001-checkout.png'

Changeset is patch. The only caller this breaks is an openHost user who did path.join(session.artifactsDir, await app.screenshot()) per the old reference text. Call it out if you want it as **Breaking:** minor instead.

Verified

Ran it locally: yes

• testbed, built CLI, e2e run tests/zz-shot.e2e.ts with a probe test asserting existsSync(await app.screenshot('home')):

main	this branch
returned: screenshots/001-home.png exists: false, test fails	returned: <testbed>/.e2e/results/zz-shot-screenshot-path-exists-…/attempt-1/screenshots/001-home.png exists: true, test passes

• open-session integration test now asserts the exact absolute path and that the file exists; it fails on main.