The looks run reports axe-core violations for each look in light and dark, and proves / renders whole without JavaScript, report-only #2970

Replaces #2941 (#2915 check 8). It waits on #2953, which brings the Finding shape from src/release/webspec.ts; the crew declined twice because that module was not on main.

Done:

• [ ] The looks run (the one that already screenshots forge.json's app.looks) also injects axe-core into each look, once with prefers-color-scheme: light and once with dark, and records the violations as Findings ({ path, check: "axe:<rule>", message, section }), citing the specification.website accessibility section.
• [ ] It renders / with JavaScript disabled and records a finding if <main> is empty or the main heading is missing.
• [ ] Findings show on the pull beside the looks. Report-only: they never fail the check.
• [ ] axe-core is a dependency of the check runner only, never imported by src/server.ts or anything it loads. The pull says why it is needed (no zero-dependency equivalent).
• [ ] Test: a fixture page with an unlabelled input yields one axe:label finding in each scheme; the no-JS render of a page that fills <main> from a script yields a finding.

Files: the looks runner, src/release/webspec.ts (the shared Finding type), a test. Risks: the looks run gets slower. Run axe once per look per scheme, and never on pages outside app.looks.