Add screenshot test validation to agent CI

.github/workflows/agent.yaml

@@ -24,25 +24,27 @@ jobs:
     name: "Agent build & test"
     runs-on: macos-26
     timeout-minutes: 45
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Copy CI gradle.properties
         run: mkdir -p ~/.gradle ; cp .github/ci-gradle.properties ~/.gradle/gradle.properties
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: 'zulu'
           java-version: 21
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v4
+        uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4
 
       - name: Run spotless
         run: ./gradlew spotlessCheck
@@ -52,12 +54,16 @@ jobs:
         run: ./gradlew test -PGEMINI_API_KEY=dummy_key
         working-directory: agent
 
+      - name: Run screenshot tests
+        run: ./gradlew validateScreenshotTest -PGEMINI_API_KEY=dummy_key
+        working-directory: agent
+
       - name: Build Debug and Release APKs
         run: ./gradlew assembleDebug assembleRelease -PGEMINI_API_KEY=dummy_key
         working-directory: agent
 
       - name: Upload Agent APKs
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: agent-apks
           path: agent/app/build/outputs/apk/**/*.apk