fix(reporters): include source code in blob to survive cross-OS merge (fix #10260)

[dokson]

Description

• Closes HTML reporter source code view is missing in some platform #10260

When sharded CI matrices produce blob reports on multiple OSes (e.g. macOS + Windows + Ubuntu) and they are then combined with `--merge-reports` on a single runner (typically Linux), the HTML reporter cannot read the test sources for paths that live on a different OS. The merger tries `fs.readFile('/Users/runner/...')` / `fs.readFile('C:...')` on its own filesystem, the read silently fails (caught by the existing `try/catch`), and the resulting `html.meta.json` ends up with no `sources` entries for those platforms. The "Code" tab in the merged HTML report is empty for any non-Linux runner.

I confirmed this on the artifact attached to #10260: out of the e2e merged report, 336 Linux files had source, 112 macOS and 112 Windows files had no source. Same pattern as the screenshots in the issue.

Fix

• Read the test sources on the producer side (`BlobReporter.onTestRunEnd`) — that runner is the one that has the files locally — and embed them in the blob (a 7th tuple element `sources: Record<string, string>`).
• `readBlobs` merges the per-blob `sources` maps into the returned `MergedBlobs` and `mergeReports` propagates them to `state.blobs.sources`.
• `HTMLReporter.onTestRunEnd` now prefers `state.blobs.sources[file.filepath]` when present, falling back to the local filesystem read (so non-merge runs are unchanged).

Test plan

• New e2e test in `test/e2e/test/reporters/merge-reports.test.ts` (`html reporter retains source for files unreachable from the merger filesystem`) that simulates the cross-OS scenario by renaming the fixture sources between the blob run and the merge run, then verifies the merged `html.meta.json.gz` still contains the source content for both files. Test fails without this patch (sources are empty maps) and passes with it.
• All 8 existing tests in `merge-reports.test.ts` still pass.

Compatibility

The 7th tuple element is optional (`sources?`) and `readBlobs` defaults to `{}` when missing, so blobs produced by older versions can still be consumed (the version-equality check in `readBlobs` already prevents cross-version mixing in practice, but the optional field keeps the type permissive).

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
• Ideally, include a test that fails without this PR but passes with it.
• Please, don't make changes to `pnpm-lock.yaml` unless you introduce a new test example.
• Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

• Run the tests with `pnpm test:ci`.

Documentation

• If you introduce new functionality, document it. You can run documentation with `pnpm run docs` command.

Changesets

• Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with `feat:`, `fix:`, `perf:`, `docs:`, or `chore:`.

[dokson]

Confirming ownership: I authored and reviewed this change myself. The marker is included per AGENTS.md guidelines for AI-assisted contributions, but the implementation and reasoning have been verified by me.

[netlify]

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	c38188e
🔍 Latest deploy log	https://app.netlify.com/projects/vitest-dev/deploys/69f8a114c0ed21000816a269
😎 Deploy Preview	https://deploy-preview-10263--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

Hello @dokson. Your PR has been labeled maybe automated because it appears to have been fully generated by AI with no human involvement. It will be closed automatically in 3 days unless a real person responds.

If you're a real person behind this contribution, please:

• Confirm you've personally reviewed and stand behind its content
• Make sure it follows our contribution guidelines and uses the correct GitHub template
• Disclose any AI tools you used (e.g. Claude, Copilot, Codex)

If you believe this was flagged by mistake, leave a comment.

These measures help us reduce maintenance burden and keep the team's work efficient. See our AI contributions policy for more context.

[dokson]

Disclosure per the AI contribution policy:

• I personally reviewed and stand behind the content of this PR. The diagnosis was verified against the artifact attached to HTML reporter source code view is missing in some platform #10260: 336 Linux files with source vs 0 macOS / 0 Windows, matching exactly the 3 ubuntu × 1 macos × 1 windows matrix in .github/workflows/ci.yml.
• It follows the contribution guidelines and the GitHub PR template (see body above), references issue HTML reporter source code view is missing in some platform #10260, and includes an e2e test that fails without the fix and passes with it.
• AI tool used: Claude (Claude Code). It assisted with code drafting and the e2e test scaffolding; the design decision (embed sources in the blob on the producer side, fall back to fs read) and the cross-OS verification are mine.