webvitals(): LCP, CLS and TBT from recorded performance entries, graded against specification.website thresholds #2982

Replaces part of #2942 (parked twice; the second attempt failed where the check ran, because it needed Lighthouse and a browser the check host lacks). This is pure: no browser, no spawn, no dependency.

Done looks like:

• [ ] src/release/webvitals.ts takes plain data (the largest-contentful-paint, layout-shift and longtask entries a page records) and returns {lcpMs, cls, tbtMs} with each graded good / needs-improvement / poor and citing its specification.website section (LCP <= 2.5 s, CLS <= 0.1, INP <= 200 ms with TBT as the lab proxy).
• [ ] CLS uses session windows (1 s gap, 5 s cap); shifts with hadRecentInput are ignored; TBT sums the part of each long task over 50 ms.
• [ ] test/webvitals.test.ts covers each rule with fixed fixtures.

Files: src/release/webvitals.ts, test/webvitals.test.ts. Risk: none at runtime; nothing calls it yet.