Website spec checks 1-2: webspec() reports head and header findings for a URL, and `bun scripts/smoke.ts <url> --standards` prints them #2953

Part of #2915 (checks 1 and 2). Prerequisite for every other website-spec issue: src/release/webspec.ts does not exist on main yet.

Done:

• [ ] src/release/webspec.ts exports webspec(base: string, paths: string[], fetcher = fetch): Promise<Finding[]>, plain data out: { path, check, message, section } where section is the specification.website section URL the finding cites.
• [ ] Check 1 (head), per path: doctype, <html lang>, charset, viewport without maximum-scale/user-scalable=no, exactly one <title>, meta description, rel=canonical equal to og:url, the light/dark theme-color pair, color-scheme, full Open Graph with og:image, icon and manifest links that resolve (2xx).
• [ ] Check 2 (headers): CSP present with no unsafe-eval and no script unsafe-inline, X-Content-Type-Options: nosniff, frame-ancestors, Referrer-Policy, Permissions-Policy, HSTS when the URL is https (finding marked edge: true since the edge may own it), no X-XSS-Protection, HTML not cached immutable while hashed assets are, ETag answered with 304 on If-None-Match.
• [ ] scripts/smoke.ts takes --standards: runs webspec() over forge.json's app.looks paths against <url>, prints one line per finding with its section, exits 0 (report-only).
• [ ] test/webspec.test.ts feeds canned Responses through the fetcher argument: a page meeting every check has no findings, and each check has a case that produces exactly its finding. No network.

The forge's own pages need not pass yet; this lands the instrument, not the fixes.

Files: src/release/webspec.ts (new), scripts/smoke.ts, test/webspec.test.ts (new). Risks: parsing HTML with regexes. Keep each check a small function over the text and the headers, with no dependency.