feat(visual-check): add --out-dir to write sidecars outside the artifact's folder

[julianwirawan-hash]

Problem and value

visual-check always writes its receipt, contact sheet, and 4 screenshots beside the input HTML, with no way to redirect them. Projects that keep delivered .json/.html result pairs separate from testing/evidence artifacts (e.g. a docs folder with a nested visual-checks/ subfolder convention) have to manually git mv every output after every single run. No existing issue link — found this while adopting archify for a project's own diagram set.

Scope

• What changed: added an optional --out-dir <dir> (also --out-dir=<dir>) to visual-check that redirects all sidecars into that directory instead, creating it if missing. Threaded through sidecarPaths() -> runVisualCheck() -> commandVisualCheck(), following the existing extractRepoRootArgs() flag-parsing pattern already used for --repo-root. Updated the usage string and the delivery-contract.md reference doc.
• What deliberately did not change: no change to sidecar content, naming, or the default (no-flag) behavior; no change to any other command.
• No unrelated changes: confirmed — diff is limited to bin/archify.mjs, bin/visual-check.mjs, references/delivery-contract.md, and the two touched test files.

Stability impact

• Compatibility and migration risk: none — fully additive, no existing call site or documented behavior changes when --out-dir is omitted.
• Renderer, validator, package, or generated-artifact risk: none — no renderer/schema/validator touched.
• Failure behavior and rollback path: --out-dir with no value fails closed (fail('--out-dir requires a directory path.'), matching --repo-root's own behavior) rather than silently ignoring the flag.

Tests run

From archify/:

• node --test test/visual-check.test.mjs — 13/13 pass (2 new: sidecarPaths with outDir, end-to-end runVisualCheck({ outDir })).
• node --test test/cli.test.mjs — 39/40 pass (2 new: real-subprocess --out-dir redirect, and the missing-value rejection case). The one pre-existing failure (cli: preview runs from an installed skill without node_modules and exits cleanly) reproduces identically on unpatched main in my sandboxed environment (a live-server-lifecycle issue, unrelated to this change) — confirmed by running it against main directly before making any change.
• npm test (from archify/, full suite): could not complete — running the full suite as one node --test test/*.mjs glob hangs indefinitely in my sandboxed Windows environment (near-zero CPU for 1.5+ hours, confirmed via process inspection, not legitimate progress). This reproduces identically on unpatched main, so it predates this change. Every individual test file listed above runs and completes normally.

Visual evidence

Not applicable — CLI/file-output behavior only, no rendered diagram or viewer change.

Generated artifacts

• archify.zip: left unchanged. scripts/build-zip.sh requires Node 22 exactly for canonical byte-identical output ("CI and releases use Node 22, so fail clearly instead of publishing different bytes from another Node major"); my environment runs Node 24.19.0. Rebuilding here would produce non-canonical bytes, which seemed worse than leaving it stale — happy to rebuild if you'd rather I attempt it anyway, or if a maintainer rebuilds on merge.
• No Gallery/README/guide regeneration needed — this change doesn't touch any of their authoritative inputs.

Checklist

• I used a minimal focused change and preserved existing typed JSON behavior unless the issue requires a contract change.
• I ran the relevant targeted tests and npm test in archify/. — targeted tests run and pass; npm test's full suite hangs in my environment (pre-existing, see above) so I could not complete it here.
• I added or updated a regression test for behavioral changes.
• I checked generated artifacts and package freshness when their sources changed. — checked; archify.zip needs a Node-22 rebuild I can't produce correctly here (see above).
• I removed secrets, private repository content, and customer data from fixtures and screenshots.