Each deployed preview of the forge is checked by webspec() and the pull shows its findings, report-only #2955

Replaces #2943 (#2915 check 10), now that its prerequisite has its own issues.

Done:

• [ ] After a preview deploy of a pull on this forge boots and its smoke proof passes, the forge runs webspec() (src/release/webspec.ts) against the preview's URL over forge.json's app.looks paths, in the same place the smoke proof runs and with the same timeout.
• [ ] The pull page shows the findings next to the smoke proof: a count and, folded, one line per finding with its specification.website section. Findings marked edge: true say the edge owns them.
• [ ] Report-only: findings never fail the deploy or the check. A note in docs/ says the gate turns failing after a week of green, and how to turn it on.
• [ ] A test boots a stand-in preview with one known gap, runs the deploy path, and asserts the stored findings name that gap. A webspec() that throws or times out is recorded as one finding and the preview stays up.

Files: the preview deploy/smoke path under src/apps/ or src/release/ (wherever the preview smoke proof runs today), the pull page view that shows the smoke proof, a test. Risks: adding latency to every preview deploy. Run it after the preview is marked live, never before.