feat: add hosted readiness report publishing

[Gandy2025]

Outcome

Adds the hosted trial report path on top of the merged atr-1 scanner core:

• deterministic, self-contained HTML rendering with a content-derived report key
• accessible desktop/mobile/print presentation and a checked First Tree example
• JSON-first S3 publication contract with honest success reporting
• public GitHub visibility gate that fails closed before render/upload
• fixed Cloud agent-readiness handoff contract while keeping the trial read-only

Private/local scans remain local. A GitHub URL alone is never treated as proof that a repository is public.

Verification

• npm test — 51/51
• npm run check
• npm audit --audit-level=high — 0 vulnerabilities
• skill validator — valid
• 12-repository calibration — 72/72 bands, zero drift; First Tree JSON byte-identical
• rendered example byte-reproducible
• Playwright visual QA at 1440px and 320px; zero console errors
• independent security/contract review — APPROVE, no HIGH/CRITICAL findings

Publication safety

The hosted flow checks the exact repository with gh repo view --json visibility and requires the exact value PUBLIC. Missing CLI, auth/access errors, lookup failures, and every non-public value terminate before rendering and before either S3 write.