Use runtime CLI signals for audits

[henrikakselsen]

Summary

• update improve-performance to require Lighthouse CLI benchmarking on production key pages (mobile + desktop, 3 runs, median reporting, best-effort partial results)
• update improve-accessibility to consume Axe CLI findings as primary signal with heuristic fallback, and report signal source in PR verification
• update find-security-issues to consume Semgrep findings as primary signal with heuristic fallback, and report detection source
• add README section documenting required CLI tools and install/verify commands for Night Shift runs
• add roadmap section for Plan B: unified normalized quality-signal ingestion in a later phase
• fix baseline tests to match current manifest/skill layout so the suite reflects the current repository state

Test plan

• Run pytest on clean main after baseline test fix
• Run pytest again on feature branch with all changes applied

Made with Cursor