ci(e2e): fan out JS/shell/Rust client jobs in e2e.yml after Python bake (#210 follow-up)

[gerchowl]

Context

Deferred from PR #211 (#210 Part B) — the unit-level CAS-retry tests + multi-source E2E landed there, but the workflow matrix expansion needs an orchestration redesign and was scoped out.

Current state

`e2e.yml` runs one job: `dagger call test-e2e` → Python pytest fixture bakes a throwaway tag, runs the round-trip, auto-cleans the tag in the fixture finalizer. Multi-language client suites (JS/shell/Rust) have e2e blocks that gate on `MAT_VIS_E2E=1 + MAT_VIS_E2E_TAG`, but the workflow doesn't run them.

What's needed

Three-step workflow:

1. bake-e2e-fixture job: dagger call to a NEW `bake_e2e_fixture` function that bakes 2 polyhaven + 2 ambientcg materials @ 1k, prints the tag to stdout. NO auto-cleanup.
2. client-tests matrix job: `needs: bake-e2e-fixture`, `strategy.matrix.lang: [js, shell, rust]`. Each runs `dagger call test-client- --tag= --e2e`. Already-existing dagger functions just need an `--e2e` toggle that sets `MAT_VIS_E2E=1` + `MAT_VIS_E2E_TAG` instead of `MAT_VIS_TAG`.
3. cleanup job: `needs: client-tests` (with `if: always()`) — dagger call to `cleanup_e2e_fixture` which deletes the branch + runs `audit-orphans`. Asserts orphans == 0 post-cleanup.

Why this matters (still)

The Python E2E gate already catches manifest emission gaps via its own bake-and-fetch. But client-side substrate slips (e.g. a JS client that builds a wrong URL, a shell client whose jq filter regresses against v3 catalogs) only surface when the client actually fetches real bytes. `test_client_*` runs against `v2026.04.0` (a non-existent legacy tag) which means those e2e blocks are skipped, not exercised.

Acceptance

• New dagger functions: `bake_e2e_fixture`, `cleanup_e2e_fixture`
• `test_client_*` accept an `--e2e` flag that swaps the env vars
• `e2e.yml` runs the 3-stage workflow nightly + on workflow_dispatch
• Cleanup job runs even when client-tests fail (so we don't leak branches on `mat-vis-tst`)
• Final `audit-orphans` assertion is 0 — proves the matrix didn't leave LFS detritus

Estimate

~80 LOC dagger + ~60 LOC YAML. Straightforward but interconnected.