[dajiaohuang]

Fixes #2945.

Problem

With d2 --watch input.d2 output.png, a local shape: image icon is written correctly into the PNG, but the SVG sent to the watch viewer still has its relative href. The browser requests that path from the watch server, which interprets it as a board name and reports render target "…" not found.

Change

Bundle the PNG preview with the same resolver used to build its raster scene, reusing bundleRasterPreview as GIF and paged exports already do. The exported PNG and preview therefore share the resolved image snapshot. No layout, browser-serving policy, flags, or help/manpage semantics change. Add a local-image PNG/preview regression and a changelog entry.

Validation

• Reproduced on master 6a7b4837838a3907604a1d9eec57ee98b6f3cd01 with a generated 1×1 PNG: the preview had a relative URL, the authenticated asset GET returned HTML, and the next WebSocket update reported the missing render target.
• The new regression fails on the unmodified implementation and passes with this change; it checks the embedded image and decodes the emitted PNG.
• Focused PNG streaming/image/preview, folder-only preview, GIF preview, and optional raster SVG tests pass.
• Rebuilt CLI: the same authenticated watch/WebSocket reproduction now sends an embedded PNG and no relative image URL.
• go test ./d2cli -count=1 -timeout=120s: only two Windows Unix-permission assertions fail (TestBoardOutputPublicationRollsBackWholeTransaction, TestIsometricImageAtomicReplacement); both also fail on unmodified master. Other package tests pass.
• go install . and git diff --check pass. Go 1.27.0, Windows amd64. Full ./make.sh, JS/WASM/race suites and cross-platform visual acceptance were not run.