Add browser accessibility, keyboard, and focus fuzzing oracles

[chubes4]

Summary

• add a provider-neutral wp-codebox/browser-accessibility/v1 contract for rule scopes, impact thresholds, cadence, capability requirements, and explicit evidence/exploration budgets
• implement bounded Playground collection inside the existing adaptive browser runner, including replay/minimization fingerprints, fail-on-finding behavior, screenshots, targeted DOM snapshots, redacted ARIA snapshots, and focus history
• add disposable pass/fail fixtures, public docs, and an adaptive campaign example

Fixes #2023

Architecture and contract

Accessibility is optional configuration on wp-codebox/browser-adaptive-exploration/v1; it does not add a browser DSL, runner, or artifact system. Runtime core owns normalized product-neutral contracts and stable fingerprints. Runtime Playground collects DOM/ARIA/focus evidence through the installed Playwright runtime and feeds finding fingerprints into the existing adaptive transition, replay, minimization, and browser artifact paths.

Recipes can declare rule tags, include/exclude scopes, impact threshold, initial/novel/final cadence, required or optional rule/focus/tree capabilities, and bounds for scans, findings, targets, focus transitions, tree characters, frames, keyboard actions, and aggregate artifacts. Existing authored actions and caller-supplied accessibilityViolations remain compatible.

Oracle coverage

• missing accessible names and invalid role relationships
• keyboard-unreachable custom controls and non-interactive tab stops
• bounded Tab, Shift+Tab, Enter, Space, Escape, and arrow-key exploration
• focus loss, hidden/inert/clipped/offscreen focus, and focus-only revisited transitions
• modal dialog focus entry/containment/restoration failures without treating non-modal dialogs as traps
• missing aria-controls targets, invalid ARIA state tokens, and expanded/selected/checked state divergence
• main-document and bounded frame findings with stable frame identity

Boundedness and privacy

• findings retain structural locators without raw DOM ids or accessible text; role/state values are length-bounded
• ARIA snapshots redact names, text, URLs, values, descriptions, and placeholders
• fingerprints exclude timestamps, screenshots, volatile ids, and transition/state context
• scan, frame, focus-history, keyboard, tree, target, duration, action, state, transition, error, and artifact byte bounds are enforced
• accessibility-enabled runs normalize impossible artifact ceilings to 1 MiB; screenshots, DOM evidence, and exact persisted JSON each consume reserved portions of the aggregate ceiling
• artifact compaction removes whole non-finding transitions and unreferenced states without mutating hashed state contents, and marks retained evidence incomplete

Limitations and inconclusive behavior

• malformed scopes are inconclusive, not passes
• unavailable tree capability is explicitly unsupported; required capability gaps make exploration incomplete, while optional gaps allow other checks to continue
• frame inspection failures are retained as diagnostics and frame count is bounded
• deterministic keyboard checks do not claim that an observable side effect outside the captured DOM/network/error evidence is absent
• accessibility naming uses bounded standards-derived DOM relationships plus Playwright ARIA snapshots; it does not introduce a separate third-party scanner dependency

Tests

Passed:

TMPDIR=/tmp npm run build:release
TMPDIR=/tmp npm run test:browser-accessibility-oracles  # 29/29
TMPDIR=/tmp npm run test:adversarial-runtime            # 16/16
TMPDIR=/tmp npm run test:browser-artifact-session
TMPDIR=/tmp npm run test:browser-visual-compare-dom-snapshots
TMPDIR=/tmp npm run test:runtime-contract-manifest
TMPDIR=/tmp npm run test:schema-parity
git diff --check

Repository-wide gate notes:

• npm run check reaches existing baseline issue command-registry-smoke fails on main: wordpress.collect-workload-result outputShape missing outputSchema id mention #1745 (wordpress.collect-workload-result output shape description).
• artifact smoke reaches existing behavior now tracked in artifact-patch-git-apply-smoke expects a worktree prefix Git does not emit #2064 (artifact-patch-git-apply-smoke expects a non-repository-relative path).
• test:release-package-coverage could not complete because its production dependency install exhausted the shared filesystem's inodes; the test cleaned its run directory, and build/package source coverage relevant to this diff is exercised by the successful release build.